diff --git a/.github/workflows/remote-docs-preview.yml b/.github/workflows/remote-docs-preview.yml
index f34799d67..a5a5b0614 100644
--- a/.github/workflows/remote-docs-preview.yml
+++ b/.github/workflows/remote-docs-preview.yml
@@ -31,14 +31,6 @@ on:
         description: Repository containing the pull request
         required: true
         type: string
-      vercel_org_id:
-        description: Vercel organization ID
-        required: true
-        type: string
-      vercel_project_id:
-        description: Vercel project ID
-        required: true
-        type: string
     secrets:
       WORKFLOW_AUTH_PUBLIC_APP_ID:
         required: true
@@ -46,6 +38,10 @@ on:
         required: true
       VERCEL_TOKEN:
         required: true
+      VERCEL_ORG_ID:
+        required: true
+      VERCEL_PROJECT_ID:
+        required: true
     outputs:
       preview_url:
         description: URL of the completed Vercel preview
@@ -166,8 +162,8 @@ jobs:
           DOCS_REMOTE_SOURCE_REPOSITORY: ${{ steps.pull-request.outputs.head_repository }}
           PULL_REQUEST_NUMBER: ${{ inputs.pull_request_number }}
           SITE_SHA: ${{ steps.site.outputs.sha }}
-          VERCEL_ORG_ID: ${{ inputs.vercel_org_id || vars.VERCEL_ORG_ID }}
-          VERCEL_PROJECT_ID: ${{ inputs.vercel_project_id || vars.VERCEL_PROJECT_ID }}
+          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
           VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
         run: |
           if ! project_response="$(
diff --git a/.github/workflows/site-preview.yml b/.github/workflows/site-preview.yml
index 1d013db98..ccb4e3990 100644
--- a/.github/workflows/site-preview.yml
+++ b/.github/workflows/site-preview.yml
@@ -151,8 +151,8 @@ jobs:
           PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number || inputs.pull_request_number }}
           TRANSLATION_SCOPE: ${{ steps.translations.outputs.scope }}
           TRUST: ${{ steps.pull-request.outputs.trust }}
-          VERCEL_ORG_ID: ${{ vars.VERCEL_ORG_ID }}
-          VERCEL_PROJECT_ID: ${{ vars.VERCEL_PROJECT_ID }}
+          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
           VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
         run: |
           repository_owner="${GITHUB_REPOSITORY%%/*}"
diff --git a/.github/workflows/site-production.yml b/.github/workflows/site-production.yml
index bbd6b69ba..3e9dade35 100644
--- a/.github/workflows/site-production.yml
+++ b/.github/workflows/site-production.yml
@@ -5,18 +5,13 @@ on:
     branches: [main]
   workflow_dispatch:
   workflow_call:
-    inputs:
-      vercel_org_id:
-        description: Vercel organization ID
-        required: true
-        type: string
-      vercel_project_id:
-        description: Vercel project ID
-        required: true
-        type: string
     secrets:
       VERCEL_TOKEN:
         required: true
+      VERCEL_ORG_ID:
+        required: true
+      VERCEL_PROJECT_ID:
+        required: true
     outputs:
       production_url:
         description: URL of the completed Vercel production deployment
@@ -69,8 +64,8 @@ jobs:
         id: deploy
         env:
           SITE_SHA: ${{ steps.site.outputs.sha }}
-          VERCEL_ORG_ID: ${{ inputs.vercel_org_id || vars.VERCEL_ORG_ID }}
-          VERCEL_PROJECT_ID: ${{ inputs.vercel_project_id || vars.VERCEL_PROJECT_ID }}
+          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
           VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
         run: |
           if ! project_response="$(
diff --git a/reports/templates/airgap-docs-preview.yml b/reports/templates/airgap-docs-preview.yml
index b355a11fa..b0d2582cb 100644
--- a/reports/templates/airgap-docs-preview.yml
+++ b/reports/templates/airgap-docs-preview.yml
@@ -26,9 +26,9 @@ jobs:
       remote_name: clickhouse-private
       pull_request_number: ${{ fromJSON(inputs.pull_request_number) }}
       source_repository: ${{ github.repository }}
-      vercel_org_id: ${{ vars.VERCEL_ORG_ID }}
-      vercel_project_id: ${{ vars.VERCEL_PROJECT_ID }}
     secrets:
       WORKFLOW_AUTH_PUBLIC_APP_ID: ${{ secrets.WORKFLOW_AUTH_PUBLIC_APP_ID }}
       WORKFLOW_AUTH_PUBLIC_PRIVATE_KEY: ${{ secrets.WORKFLOW_AUTH_PUBLIC_PRIVATE_KEY }}
       VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+      VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
diff --git a/src/README.md b/src/README.md
index e2ced7ca4..f01c1059c 100644
--- a/src/README.md
+++ b/src/README.md
@@ -116,8 +116,9 @@ Vercel must be provisioned as follows:
 7. Keep standard Preview free of secrets and privileged integrations. Every
    base-repository pull request builds from the primary repository's synthetic
    merge ref in this environment and omits registered remotes.
-8. Add `VERCEL_ORG_ID` and `VERCEL_PROJECT_ID` as GitHub Actions variables and
-   `VERCEL_TOKEN` as a GitHub Actions secret.
+8. Add `VERCEL_TOKEN`, `VERCEL_ORG_ID`, and `VERCEL_PROJECT_ID` as repository
+   secrets under GitHub Actions. Do not store them as repository variables or
+   environment-scoped secrets.
 9. Keep the Vercel build command as `pnpm run build:vercel` and the output
    directory as `dist`.