diff --git a/.forgejo/workflows/grade.yml b/.forgejo/workflows/grade.yml
index 9ae7e97..ec53f28 100644
--- a/.forgejo/workflows/grade.yml
+++ b/.forgejo/workflows/grade.yml
@@ -2,12 +2,11 @@ name: grade
 on: [push]
 
 # Production wiring (forgejo-runner on ghost):
-#   - forgejo-runner v13: docker_host: automount -> the job container gets the
-#     host docker socket, so docker_grade.sh drives the host daemon as designed
-#   - hidden tests mount from the runner host via the nested docker run
-#     (-v /opt/grade-hidden/...) — never in this repo
-#   - GRADE_HMAC_SECRET is a Forgejo org/repo Actions secret (set via API),
-#     injected with ${{ secrets.GRADE_HMAC_SECRET }}
+#   - forgejo-runner v13 config: docker_host: automount -> the job container
+#     gets the host docker socket, so `docker run` drives the host daemon
+#   - the nested grade container mounts the secret + hidden tests straight from
+#     the host (/opt/grade/grade.env, /opt/grade-hidden/...) — never in this
+#     repo, no job-container options, no Actions secrets required
 jobs:
   grade:
     runs-on: docker
@@ -16,17 +15,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Grade (blank fails, solved passes)
-        env:
-          GRADE_HMAC_SECRET: ${{ secrets.GRADE_HMAC_SECRET }}
         run: |
           docker run --rm --network=none \
             -v "$PWD":/work \
+            -v /opt/grade/grade.env:/run/secrets/grade.env:ro \
             -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \
-            -e GRADE_HMAC_SECRET \
+            -v /opt/grade/runner-diag:/diag \
             grade-c:dev \
-            python3 /opt/grade/grade_cli.py run \
-              --student /work --hidden /hidden \
-              --course CS2060 --assignment record-manager \
-              --out /work/results.json
-          echo "--- signed result summary ---"
-          head -c 400 results.json
+            sh -c 'set -a; . /run/secrets/grade.env; set +a; { echo "SECRET_LEN=${#GRADE_HMAC_SECRET}"; python3 /opt/grade/grade_cli.py run --student /work --hidden /hidden --course CS2060 --assignment record-manager --out /work/results.json; } 2>&1 | tee /diag/latest.log'
+          echo "job-step exit=$?"