diff --git a/packages/deploy_pipeline.yaml b/packages/deploy_pipeline.yaml
index a9d8c5a..cf8fa40 100644
--- a/packages/deploy_pipeline.yaml
+++ b/packages/deploy_pipeline.yaml
@@ -25,4 +25,4 @@ rest:
 # pushing — crash, wedge, power loss, network partition — Kuma pages
 # the founder's phone directly. No HA in the alert loop.
 shell_command:
-  kuma_ha_heartbeat: 'curl -sS -m 15 "{{ kuma_push_url }}"'
+  kuma_ha_heartbeat: !secret kuma_heartbeat_cmd  # CR21 2026-09-06: runtime template contexts cannot read secrets; the old {{ }} form rendered undefined and the dead-man never pushed