diff --git a/app/jitsi/config/jicofo.conf b/app/jitsi/config/jicofo.conf
index 1d33b9c..cde4eb6 100644
--- a/app/jitsi/config/jicofo.conf
+++ b/app/jitsi/config/jicofo.conf
@@ -243,7 +243,7 @@ jicofo {
       port = {{ env "NOMAD_PORT_xmpp_port" }}
       domain = "auth.jitsi"
       username = "focus"
-      password = {{ key "secrets/jitsi/jitsi_secret_jicofo_user" }}
+      password = {{ key "secrets/jitsi/jicofo_pass" }}
 
       // How long to wait for a response to a stanza before giving up.
       reply-timeout = 15 seconds
diff --git a/app/jitsi/config/videobridge.conf b/app/jitsi/config/videobridge.conf
index 9307945..7f85f3c 100644
--- a/app/jitsi/config/videobridge.conf
+++ b/app/jitsi/config/videobridge.conf
@@ -66,7 +66,7 @@ videobridge {
           port = {{ env "NOMAD_PORT_xmpp_port" }}
           domain = "auth.jitsi"
           username = "jvb"
-          password = "{{ key "secrets/jitsi/jitsi_secret_jvb_user" }}"
+          password = "{{ key "secrets/jitsi/jvb_pass" }}"
           muc_jids = "jvbbrewery@internal.auth.jitsi"
           # The muc_nickname must be unique across all jitsi-videobridge instances
           muc_nickname = "unique-jvb-server"
diff --git a/app/jitsi/deploy/jitsi.hcl b/app/jitsi/deploy/jitsi.hcl
index 82fdfcd..bf7d6b5 100644
--- a/app/jitsi/deploy/jitsi.hcl
+++ b/app/jitsi/deploy/jitsi.hcl
@@ -23,10 +23,10 @@ job "jitsi" {
         ports = [ "bosh_port", "xmpp_port" ]
         network_mode = "host"
         volumes = [
-          "secrets/prosody.cfg.lua:/etc/prosody/prosody.cfg.lua"
-          "secrets/certs/auth.jitsi.crt:/var/lib/prosody/auth.jitsi.crt"
-          "secrets/certs/auth.jitsi.key:/var/lib/prosody/auth.jitsi.key"
-          "secrets/certs/jitsi.crt:/var/lib/prosody/jitsi.crt"
+          "secrets/prosody.cfg.lua:/etc/prosody/prosody.cfg.lua",
+          "secrets/certs/auth.jitsi.crt:/var/lib/prosody/auth.jitsi.crt",
+          "secrets/certs/auth.jitsi.key:/var/lib/prosody/auth.jitsi.key",
+          "secrets/certs/jitsi.crt:/var/lib/prosody/jitsi.crt",
           "secrets/certs/jitsi.key:/var/lib/prosody/jitsi.key"
         ]
       }
@@ -104,9 +104,9 @@ EOF
         network_mode = "host"
         ports = [ "https_port" ]
         volumes = [
-          "secrets/certs/jitsi.crt:/etc/nginx/jitsi.crt"
-          "secrets/certs/jitsi.key:/etc/nginx/jitsi.key"
-          "secrets/config.js:/srv/jitsi-meet/config.js"
+          "secrets/certs/jitsi.crt:/etc/nginx/jitsi.crt",
+          "secrets/certs/jitsi.key:/etc/nginx/jitsi.key",
+          "secrets/config.js:/srv/jitsi-meet/config.js",
           "secrets/nginx.conf:/etc/nginx/nginx.conf"
         ]
       }
@@ -114,13 +114,11 @@ EOF
       template {
         data = file("../config/config.js")
         destination = "secrets/config.js"
-        env = true
       }
 
       template {
         data = file("../config/nginx.conf")
         destination = "secrets/nginx.conf"
-        env = true
       }
 
       # --- secrets ---
@@ -169,8 +167,8 @@ EOF
         image = "superboum/amd64_jitsi_conference_focus:v7"
         network_mode = "host"
         volumes = [
-          "secrets/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt"
-          "secrets/certs/auth.jitsi.crt:/usr/local/share/ca-certificates/auth.jitsi.crt"
+          "secrets/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt",
+          "secrets/certs/auth.jitsi.crt:/usr/local/share/ca-certificates/auth.jitsi.crt",
           "secrets/jicofo.conf:/etc/jitsi/jicofo.conf"
         ]
       }
@@ -208,8 +206,8 @@ EOF
           nproc = "65536:65536"
         }
         volumes = [
-          "secrets/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt"
-          "secrets/certs/auth.jitsi.crt:/usr/local/share/ca-certificates/auth.jitsi.crt"
+          "secrets/certs/jitsi.crt:/usr/local/share/ca-certificates/jitsi.crt",
+          "secrets/certs/auth.jitsi.crt:/usr/local/share/ca-certificates/auth.jitsi.crt",
           "secrets/videobridge.conf:/etc/jitsi/videobridge.conf"
         ]
       }
@@ -224,7 +222,6 @@ EOF
       template {
         data = file("../config/videobridge.conf")
         destination = "secrets/videobridge.conf"
-        env = true
       }
 
       # --- secrets ---