diff --git a/bamboo-specs/release.yaml b/bamboo-specs/release.yaml
index 0cc36389d..fe9b4de04 100644
--- a/bamboo-specs/release.yaml
+++ b/bamboo-specs/release.yaml
@@ -113,21 +113,29 @@
 
                 docker info
 
+                # Disable xtrace so the expanded secret values aren't printed to
+                # the build log.
+                set +x
+                export GPG_KEY_PASSPHRASE="${bamboo_gpgPassword}"
+                export GPG_SECRET_KEY="${bamboo_gpgSecretKeyPart1}${bamboo_gpgSecretKeyPart2}"
+                export SIGNER_API_KEY="${bamboo_adguardHomeWinSignerSecretApiKey}"
+                set -x
+
                 docker build \
                     --build-arg "BASE_IMAGE=${bamboo_dockerGo}" \
                     --build-arg "BRANCH=${bamboo_planRepository_branchName}" \
                     --build-arg "CACHE_BUSTER=${bamboo_cacheBuster}" \
                     --build-arg "CHANNEL=${bamboo_channel}" \
                     --build-arg "DEPLOY_SCRIPT_PATH=./bamboo-deploy-publisher/deploy.sh" \
-                    --build-arg "GPG_SECRET_KEY=${bamboo_gpgSecretKeyPart1}${bamboo_gpgSecretKeyPart2}" \
-                    --build-arg "GPG_KEY_PASSPHRASE=${bamboo_gpgPassword}" \
                     --build-arg "REVISION=${bamboo_repository_revision_number}" \
                     --build-arg "SIGN=1" \
-                    --build-arg "SIGNER_API_KEY=${bamboo_adguardHomeWinSignerSecretApiKey}" \
                     --build-arg "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" \
                     --build-arg "VERSION=$version" \
                     --output '.' \
                     --progress 'plain' \
+                    --secret id=GPG_KEY_PASSPHRASE \
+                    --secret id=GPG_SECRET_KEY \
+                    --secret id=SIGNER_API_KEY \
                     --target 'builder-exporter' \
                     -f ./docker/ci.Dockerfile \
                     .
diff --git a/bamboo-specs/snapcraft.yaml b/bamboo-specs/snapcraft.yaml
index 8757a03c3..67b4a3b62 100644
--- a/bamboo-specs/snapcraft.yaml
+++ b/bamboo-specs/snapcraft.yaml
@@ -98,14 +98,20 @@
 
                 docker info
 
+                # Disable xtrace so the expanded secret values aren't printed to
+                # the build log.
+                set +x
+                export SNAPCRAFT_STORE_CREDENTIALS="${bamboo_snapcraftMacaroonPassword}"
+                set -x
+
                 docker build \
                     --build-arg "BASE_IMAGE=${bamboo_dockerSnap}" \
                     --build-arg "CACHE_BUSTER=${bamboo_cacheBuster}" \
                     --build-arg "SNAPCRAFT_CHANNEL=${bamboo_snapcraftChannel}" \
-                    --build-arg "SNAPCRAFT_STORE_CREDENTIALS=${bamboo_snapcraftMacaroonPassword}" \
                     --build-arg "VERSION=${bamboo_buildNumber}" \
                     --output '.' \
                     --progress 'plain' \
+                    --secret id=SNAPCRAFT_STORE_CREDENTIALS \
                     --target 'publisher' \
                     -f ./docker/snapcraft.Dockerfile \
                     .
diff --git a/docker/ci.Dockerfile b/docker/ci.Dockerfile
index b290e3d5e..5cabdee64 100644
--- a/docker/ci.Dockerfile
+++ b/docker/ci.Dockerfile
@@ -153,12 +153,9 @@ ARG BRANCH=master
 ARG CACHE_BUSTER=0
 ARG CHANNEL=development
 ARG DEPLOY_SCRIPT_PATH=not/a/real/path
-ARG GPG_KEY_PASSPHRASE=not-a-real-passphrase
-ARG GPG_SECRET_KEY=""
 ARG OS=""
 ARG REVISION=0000000000000000000000000000000000000000
 ARG SIGN=0
-ARG SIGNER_API_KEY=not-a-real-key
 ARG SOURCE_DATE_EPOCH=0
 ARG VERSION=""
 ADD . /app
@@ -166,6 +163,9 @@ WORKDIR /app
 RUN \
 	--mount=type=cache,id=gocache,target=/root/.cache/go-build \
 	--mount=type=cache,id=gopath,target=/go \
+	--mount=type=secret,id=GPG_KEY_PASSPHRASE,env=GPG_KEY_PASSPHRASE \
+	--mount=type=secret,id=GPG_SECRET_KEY,env=GPG_SECRET_KEY \
+	--mount=type=secret,id=SIGNER_API_KEY,env=SIGNER_API_KEY \
 <<-'EOF'
 set -e -f -u -x
 
diff --git a/docker/snapcraft.Dockerfile b/docker/snapcraft.Dockerfile
index a0e7709f1..c3c4aa345 100644
--- a/docker/snapcraft.Dockerfile
+++ b/docker/snapcraft.Dockerfile
@@ -67,7 +67,6 @@ COPY --from=builder /app/AdGuardHome_i386.snap /AdGuardHome_i386.snap
 FROM "$BASE_IMAGE" AS publisher
 ARG CACHE_BUSTER=0
 ARG SNAPCRAFT_CHANNEL=0
-ARG SNAPCRAFT_STORE_CREDENTIALS=0
 ARG VERSION=""
 ADD snap /app/snap
 ADD scripts /app/scripts
@@ -77,12 +76,12 @@ ADD AdGuardHome_armhf.snap /app/AdGuardHome_armhf.snap
 ADD AdGuardHome_i386.snap /app/AdGuardHome_i386.snap
 WORKDIR /app
 RUN \
+    --mount=type=secret,id=SNAPCRAFT_STORE_CREDENTIALS,env=SNAPCRAFT_STORE_CREDENTIALS \
 <<-'EOF'
 set -e -f -u -x
 
 env \
 	SNAPCRAFT_CHANNEL="${SNAPCRAFT_CHANNEL}" \
-	SNAPCRAFT_STORE_CREDENTIALS="${SNAPCRAFT_STORE_CREDENTIALS}" \
 	VERBOSE='1' \
 	sh ./scripts/snap/upload.sh
 EOF