diff --git a/internal/httpapi/deploy.go b/internal/httpapi/deploy.go
index a2d4f4b..047c27c 100644
--- a/internal/httpapi/deploy.go
+++ b/internal/httpapi/deploy.go
@@ -12,7 +12,7 @@ func (h Handler) handleDeploy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if r.Header.Get("X-Deploy-Secret") != h.cfg.DeploySecret {
+	if r.URL.Query().Get("secret") != h.cfg.DeploySecret {
 		writeError(w, http.StatusUnauthorized, "invalid deploy secret")
 		return
 	}