diff --git a/services/gitea/deployment.yaml b/services/gitea/deployment.yaml
index 69650ca..a5fa9c4 100644
--- a/services/gitea/deployment.yaml
+++ b/services/gitea/deployment.yaml
@@ -67,9 +67,9 @@ spec:
             - -c
             - |
               set -euo pipefail
-              CLIENT_ID="$(cat /vault/secrets/gitea-oidc__client_id)"
-              CLIENT_SECRET="$(cat /vault/secrets/gitea-oidc__client_secret)"
-              DISCOVERY_URL="$(cat /vault/secrets/gitea-oidc__openid_auto_discovery_url)"
+              CLIENT_ID="$(tr -d '\r\n' </vault/secrets/gitea-oidc__client_id)"
+              CLIENT_SECRET="$(tr -d '\r\n' </vault/secrets/gitea-oidc__client_secret)"
+              DISCOVERY_URL="$(tr -d '\r\n' </vault/secrets/gitea-oidc__openid_auto_discovery_url)"
               APPINI=/data/gitea/conf/app.ini
               BIN=/usr/local/bin/gitea
 
@@ -133,9 +133,9 @@ spec:
           args:
             - |
               set -euo pipefail
-              export GITEA__security__SECRET_KEY="$(cat /vault/secrets/gitea-secret__SECRET_KEY)"
-              export GITEA__security__INTERNAL_TOKEN="$(cat /vault/secrets/gitea-secret__INTERNAL_TOKEN)"
-              export DB_PASS="$(cat /vault/secrets/gitea-db-secret__password)"
+              export GITEA__security__SECRET_KEY="$(tr -d '\r\n' </vault/secrets/gitea-secret__SECRET_KEY)"
+              export GITEA__security__INTERNAL_TOKEN="$(tr -d '\r\n' </vault/secrets/gitea-secret__INTERNAL_TOKEN)"
+              export DB_PASS="$(tr -d '\r\n' </vault/secrets/gitea-db-secret__password)"
               exec /usr/bin/entrypoint /usr/bin/s6-svscan /etc/s6
           ports:
             - containerPort: 3000