diff --git a/.env.ci b/.env.ci
index 8ccac62..bc224c1 100644
--- a/.env.ci
+++ b/.env.ci
@@ -6,7 +6,12 @@ DOTENV_PUBLIC_KEY_CI="032103eb1e7702e37bb3984406735919acc5a4b4689c5d2fb5ce6a81fe
 
 # .env.ci
 
-RHQCR_BOT_USERNAME="ajhalili2006+gildedguy"
-RHQCR_BOT_PASSWORD="encrypted:BLwuPfq5ZMtc57/+bS2/baWqvtoc3M4wNQXJVNDAaZ/7sLtsShkVHcaFMGiUjd8Lft77+vCNiz/qUg0uzl6HaO7Q0/+UbPtCl7vIy+oUbm4+2VT1uKAUq29euSOYvUA7YMyyeKse1TtPVjw2wEygUsjmrnPW83ZcuxvZTv3fjmPWj9uHqC9qMCWLoE+9JnyGswO+8B8cCI6f0YkM2cbS7Hk="
+RHQCR_BOT_USERNAME="andreijiroh-dev+buildops"
+RHQCR_BOT_PASSWORD="encrypted:BA33pWW6P3XyHttPRI3REsk3RlYhEYQEhAzWfnOJ29ZIUbOjTubbgELjFj9++I4fBjPwG6mqDXsSfA7o4QcLxZl91IW93DCcBleQNbEjpcz3Fec3I6EHDoljd+mfi/5TyT/AyDPvUi/52AXyVKliD7b4dPeZoNomvbmC+R/MACrqFkUTyB67fXqESMl6NX6NUzntvv6dE34warTuhxC1LZM="
 GHCR_BOT_USERNAME="ajhalili2006-bot"
-GHCR_BOT_PASSWORD="encrypted:BC54xpjbop6qE+BegAjMk72A62FmFT67DWcnmM8yNkedIo6e9tWWzfwjpSulwQ9Y130xiz4X93pLs8Sd5PGcaC7pUFXgptrAi592ExeM/cmoYsvqwEgIM5qMu5QS3n6EAMHQnXMBovZbPDg007tA7MqnQuRvBhQy6Oxd+5XVIChEZ9Pa1Qa2XvE="
\ No newline at end of file
+GHCR_BOT_PASSWORD="encrypted:BC54xpjbop6qE+BegAjMk72A62FmFT67DWcnmM8yNkedIo6e9tWWzfwjpSulwQ9Y130xiz4X93pLs8Sd5PGcaC7pUFXgptrAi592ExeM/cmoYsvqwEgIM5qMu5QS3n6EAMHQnXMBovZbPDg007tA7MqnQuRvBhQy6Oxd+5XVIChEZ9Pa1Qa2XvE="
+GLCR_MAUDEV_BOT_USERNAME="group_1163_bot_50426011345d412b78d88b3c04e28188"
+GLCR_MAUDEV_BOT_TOKEN="encrypted:BAUADYiclFnhruKSaPb1AALSdrxecUWfWULbATMkRByQex9QmI2OI/IQ9AjU9wyK0BuRZdCKgdqZbyhx4FC1rye51PkCkgNvOtlMVNpkYwZQFIvOKoSoI9a6NRcT04cbK8AfMPZVmn1SttH0qgL8lyBmx/fen4fgDmjw"
+GLCR_MAUDEV_BOT_PASSWORD=$GLCR_MAUDEV_BOT_TOKEN
+GITLAB_MAUDEV_MIRROR_TOKEN="encrypted:BPtwanaz7QJPbYOaEegPsqne3STaq0FwQEDoagxcRA3RdhQ3R1SFHehQ2x25lulYFxNAJHm+6Ss8jd4OC0W4Ev8EeDFf9Lj1ZEUJDFtURcPqf+g+ZZD2Bd57uBHHKvIpBO8fM39ByPLGGCDM2DmXKZfpnU3ONlRDb+U+"
+GITLAB_MAUDEV_MIRROR_USERNAME="group_1163_bot_989cf754612262d73ad44ef418952bb9"
diff --git a/.github/workflows/docker-buildops.yml b/.github/workflows/docker-buildops.yml
index f1c1120..463b395 100644
--- a/.github/workflows/docker-buildops.yml
+++ b/.github/workflows/docker-buildops.yml
@@ -49,6 +49,13 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+      - name: Load secrets with dotenvx
+        uses: andreijiroh-dev/dotenvx-action@v0.2.0
+        if: github.event_name == 'pull_request'
+        id: dotenvx
+        with:
+          path: .env.ci
+          key: ${{ secrets.DOTENV_PRIVATE_KEY_CI }}
 
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
@@ -63,22 +70,22 @@ jobs:
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
+          username: ${{ steps.dotenvx.outputs.GHCR_BOT_USERNAME }}
+          password: ${{ steps.dotenvx.outputs.GHCR_BOT_PASSWORD }}
       - name: Log into RHQCR
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
         with:
           registry: quay.io
-          username: ${{ secrets.RHQCR_BOT_USERNAME }}
-          password: ${{ secrets.RHQCR_BOT_TOKEN }}
+          username: ${{ steps.dotenvx.outputs.RHQCR_BOT_USERNAME }}
+          password: ${{ steps.dotenvx.outputs.RHQCR_BOT_TOKEN }}
       - name: Login into GLCR on mau.dev
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
         with:
           registry: dock.mau.dev
-          username: ${{ secrets.GLCR_MAUDEV_DEPLOY_USERNAME }}
-          password: ${{ secrets.GLCR_MAUDEV_DEPLOY_TOKEN }}
+          username: ${{ steps.dotenvx.outputs.GLCR_MAUDEV_BOT_USERNAME }}
+          password: ${{ steps.dotenvx.outputs.GLCR_MAUDEV_BOT_PASSWORD }}
       
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer
@@ -162,7 +169,9 @@ jobs:
         if: ${{ github.event_name == 'schedule' }}
         id: attest-nightly-builds
         with:
-          subject-name: ghcr.io/${{ env.IMAGE_NAME_PREFIX }}/mkdocs-material
+          subject-path: |
+            ghcr.io/${{ env.IMAGE_NAME_PREFIX }}/mkdocs-material
+            dock.mau.dev/${{ env.IMAGE_NAME_PREFIX }}/mkdocs-material
           subject-digest: ${{ steps.nightly-build.outputs.digest }}
           push-to-registry: true
       - name: Generate attestation for GitHub API access
diff --git a/.github/workflows/reposync.yml b/.github/workflows/reposync.yml
index 28bc1f8..d1523fb 100644
--- a/.github/workflows/reposync.yml
+++ b/.github/workflows/reposync.yml
@@ -12,11 +12,18 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: "0"
+      - name: Load secrets with dotenvx
+        uses: andreijiroh-dev/dotenvx-action@v0.2.0
+        if: github.event_name == 'pull_request'
+        id: dotenvx
+        with:
+          path: .env.ci
+          key: ${{ secrets.DOTENV_PRIVATE_KEY_CI }}
       - name: Setup git
         run: |
           git config --global user.name "Recap Time Bot"
           git config --global user.email "service-accounts+git@recaptime.dev"
-          git remote add gitlab "https://${{ secrets.GLCR_MAUDEV_DEPLOY_USERNAME }}:${{ secrets.GLCR_MAUDEV_DEPLOY_TOKEN }}@mau.dev/andreijiroh-dev/docker-images"
+          git remote add gitlab "https://${{ steps.dotenvx.outputs.GITLAB_MAUDEV_MIRROR_USERNAME }}:${{ steps.dotenvx.outputs.GITLAB_MAUDEV_MIRROR_TOKEN }}@mau.dev/andreijiroh-dev/docker-images"
           git fetch gitlab
       - name: Sync with GitLab repo
         run: |