diff --git a/justfile b/justfile
index a475505..06f2200 100644
--- a/justfile
+++ b/justfile
@@ -38,20 +38,28 @@ rebuild os tag arch package *versions:
       arm64) builder="{{ arm64_builder }}" ;;
       *) echo "error: arch must be 'amd64' or 'arm64'" >&2; exit 1 ;;
     esac
-    : "${B2_S3_ACCESS_KEY:?set B2_S3_ACCESS_KEY in your environment}"
-    : "${B2_S3_SECRET_KEY:?set B2_S3_SECRET_KEY in your environment}"
-    : "${PGPASS:?set PGPASS in your environment}"
-    : "${GITHUB_PAT:=}"
+    # Accept TF_VAR_-prefixed names (direnv) or plain names.
+    export B2_S3_ACCESS_KEY="${B2_S3_ACCESS_KEY:-${TF_VAR_B2_S3_ACCESS_KEY:-}}"
+    export B2_S3_SECRET_KEY="${B2_S3_SECRET_KEY:-${TF_VAR_B2_S3_SECRET_KEY:-}}"
+    : "${B2_S3_ACCESS_KEY:?set B2_S3_ACCESS_KEY or TF_VAR_B2_S3_ACCESS_KEY}"
+    : "${B2_S3_SECRET_KEY:?set B2_S3_SECRET_KEY or TF_VAR_B2_S3_SECRET_KEY}"
+    : "${PGPASS:?set PGPASS}"
+    secret_args=(
+      --secret id=b2_access,env=B2_S3_ACCESS_KEY
+      --secret id=b2_secret,env=B2_S3_SECRET_KEY
+      --secret id=pgpass,env=PGPASS
+    )
+    # GITHUB_PAT is optional (raises the GitHub API rate limit); pass only if set.
+    if [ -n "${GITHUB_PAT:-}" ]; then
+      secret_args+=(--secret id=github_pat,env=GITHUB_PAT)
+    fi
     echo "Dispatching build of {{ package }} ({{ versions }}) on {{ os }}:{{ tag }}/{{ arch }} (R {{ r_version }}) to builder '$builder'"
     docker buildx build \
       --builder "$builder" \
       --platform "linux/{{ arch }}" \
       --no-cache \
       --output type=cacheonly \
-      --secret id=b2_access,env=B2_S3_ACCESS_KEY \
-      --secret id=b2_secret,env=B2_S3_SECRET_KEY \
-      --secret id=pgpass,env=PGPASS \
-      --secret id=github_pat,env=GITHUB_PAT \
+      "${secret_args[@]}" \
       --build-arg OS="{{ os }}" \
       --build-arg OS_VERSION="{{ tag }}" \
       --build-arg R_VERSION="{{ r_version }}" \