diff --git a/.gitea/workflows/handy-update.yml b/.gitea/workflows/handy-update.yml
index f3ccf77..3220390 100644
--- a/.gitea/workflows/handy-update.yml
+++ b/.gitea/workflows/handy-update.yml
@@ -1,8 +1,6 @@
 name: handy update
 
 on:
-  push:
-    branches: [main]
   schedule:
     - cron: "40 6 * * *"
   workflow_dispatch:
diff --git a/.gitea/workflows/helium-update.yml b/.gitea/workflows/helium-update.yml
index 18b1129..0f16097 100644
--- a/.gitea/workflows/helium-update.yml
+++ b/.gitea/workflows/helium-update.yml
@@ -57,12 +57,16 @@ jobs:
           url="https://github.com/imputnet/helium-linux/releases/download/${latest_version}/helium-${latest_version}-x86_64.AppImage"
           new_hash=$(nix store prefetch-file --json "$url" | python -c 'import json,sys; print(json.load(sys.stdin)["hash"])')
 
+          export LATEST_VERSION="$latest_version"
+          export NEW_HASH="$new_hash"
+
           python - <<PY
           import re
+          import os
           p='modules/pkgs/helium.nix'
           s=open(p).read()
-          s=re.sub(r'version\s*=\s*"[^"]+"', f'version = "{latest_version}"', s, count=1)
-          s=re.sub(r'hash\s*=\s*"[^"]+"', f'hash = "{new_hash}"', s, count=1)
+          s=re.sub(r'version\s*=\s*"[^"]+"', f'version = "{os.environ["LATEST_VERSION"]}"', s, count=1)
+          s=re.sub(r'hash\s*=\s*"[^"]+"', f'hash = "{os.environ["NEW_HASH"]}"', s, count=1)
           open(p,'w').write(s)
           PY
 
diff --git a/.gitea/workflows/zen-browser-update.yml b/.gitea/workflows/zen-browser-update.yml
index fee8f39..63cef70 100644
--- a/.gitea/workflows/zen-browser-update.yml
+++ b/.gitea/workflows/zen-browser-update.yml
@@ -55,12 +55,16 @@ jobs:
           url="https://github.com/zen-browser/desktop/releases/download/${latest_version}/zen-x86_64.AppImage"
           new_hash=$(nix store prefetch-file --json "$url" | python -c 'import json,sys; print(json.load(sys.stdin)["hash"])')
 
+          export LATEST_VERSION="$latest_version"
+          export NEW_HASH="$new_hash"
+
           python - <<PY
           import re
+          import os
           p='modules/pkgs/zen-browser.nix'
           s=open(p).read()
-          s=re.sub(r'version\s*=\s*"[^"]+"', f'version = "{latest_version}"', s, count=1)
-          s=re.sub(r'hash\s*=\s*"[^"]+"', f'hash = "{new_hash}"', s, count=1)
+          s=re.sub(r'version\s*=\s*"[^"]+"', f'version = "{os.environ["LATEST_VERSION"]}"', s, count=1)
+          s=re.sub(r'hash\s*=\s*"[^"]+"', f'hash = "{os.environ["NEW_HASH"]}"', s, count=1)
           open(p,'w').write(s)
           PY