diff --git a/.github/workflows/cd-apps.yml b/.github/workflows/cd-apps.yml
index f36b864..d102342 100644
--- a/.github/workflows/cd-apps.yml
+++ b/.github/workflows/cd-apps.yml
@@ -38,7 +38,8 @@ jobs:
           curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
           chmod +x sops-v3.9.4.linux.amd64
           SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env > /tmp/secrets.env
-          echo "SENTRY_AUTH_TOKEN=$(grep SENTRY_AUTH_TOKEN /tmp/secrets.env | cut -d= -f2-)" >> "$GITHUB_ENV"
+          grep SENTRY_AUTH_TOKEN /tmp/secrets.env | cut -d= -f2- > /tmp/sentry_token
+          echo "${{ github.sha }}" > /tmp/sentry_release
 
       - uses: docker/build-push-action@v7
         with:
@@ -48,9 +49,9 @@ jobs:
           tags: |
             ghcr.io/trails-cool/${{ matrix.app }}:latest
             ghcr.io/trails-cool/${{ matrix.app }}:${{ github.sha }}
-          build-args: |
-            SENTRY_AUTH_TOKEN=${{ env.SENTRY_AUTH_TOKEN }}
-            SENTRY_RELEASE=${{ github.sha }}
+          secrets: |
+            SENTRY_AUTH_TOKEN=/tmp/sentry_token
+            SENTRY_RELEASE=/tmp/sentry_release
 
   deploy:
     name: Deploy Apps
diff --git a/apps/journal/Dockerfile b/apps/journal/Dockerfile
index 95efd79..5f86253 100644
--- a/apps/journal/Dockerfile
+++ b/apps/journal/Dockerfile
@@ -12,13 +12,16 @@ COPY packages/gpx/package.json packages/gpx/
 COPY packages/i18n/package.json packages/i18n/
 COPY packages/db/package.json packages/db/
 RUN pnpm install --frozen-lockfile
+RUN pnpm approve-builds @sentry/cli esbuild && pnpm install --frozen-lockfile
 
 FROM base AS build
-ARG SENTRY_AUTH_TOKEN
-ARG SENTRY_RELEASE
 COPY --from=deps /app/ ./
 COPY . .
-RUN pnpm --filter @trails-cool/journal build
+RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
+    --mount=type=secret,id=SENTRY_RELEASE \
+    SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null)" \
+    SENTRY_RELEASE="$(cat /run/secrets/SENTRY_RELEASE 2>/dev/null)" \
+    pnpm --filter @trails-cool/journal build
 
 FROM base AS runtime
 RUN addgroup --system app && adduser --system --ingroup app app
diff --git a/apps/planner/Dockerfile b/apps/planner/Dockerfile
index 4b299eb..0e44ad7 100644
--- a/apps/planner/Dockerfile
+++ b/apps/planner/Dockerfile
@@ -12,13 +12,16 @@ COPY packages/gpx/package.json packages/gpx/
 COPY packages/i18n/package.json packages/i18n/
 COPY packages/db/package.json packages/db/
 RUN pnpm install --frozen-lockfile
+RUN pnpm approve-builds @sentry/cli esbuild && pnpm install --frozen-lockfile
 
 FROM base AS build
-ARG SENTRY_AUTH_TOKEN
-ARG SENTRY_RELEASE
 COPY --from=deps /app/ ./
 COPY . .
-RUN pnpm --filter @trails-cool/planner build
+RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
+    --mount=type=secret,id=SENTRY_RELEASE \
+    SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null)" \
+    SENTRY_RELEASE="$(cat /run/secrets/SENTRY_RELEASE 2>/dev/null)" \
+    pnpm --filter @trails-cool/planner build
 
 FROM base AS runtime
 RUN addgroup --system app && adduser --system --ingroup app app