diff --git a/justfile b/justfile
index b70f549..a475505 100644
--- a/justfile
+++ b/justfile
@@ -7,11 +7,9 @@
 # refreshed so the result is immediately servable.
 #
 # Prerequisites:
-#   - buildx builders named `artemis` (amd64) and `gaia` (arm64), created with the
-#     docker-container driver (runs BuildKit on the remote host's docker daemon over
-#     SSH). The default `remote` driver does NOT work with an ssh:// docker host.
-#       docker buildx create --name artemis --driver docker-container ssh://<user@host-amd64>
-#       docker buildx create --name gaia    --driver docker-container ssh://<user@host-arm64>
+#   - buildx builders named `artemis` (amd64) and `gaia` (arm64), e.g.
+#       docker buildx create --name artemis --node artemis ssh://<host-amd64>
+#       docker buildx create --name gaia    --node gaia    ssh://<host-arm64>
 #   - exported secrets: B2_S3_ACCESS_KEY, B2_S3_SECRET_KEY, PGPASS (GITHUB_PAT optional)
 #
 # Overridable (env or `just VAR=… rebuild …`):
@@ -40,28 +38,20 @@ rebuild os tag arch package *versions:
       arm64) builder="{{ arm64_builder }}" ;;
       *) echo "error: arch must be 'amd64' or 'arm64'" >&2; exit 1 ;;
     esac
-    # Accept TF_VAR_-prefixed names (direnv) or plain names.
-    export B2_S3_ACCESS_KEY="${B2_S3_ACCESS_KEY:-${TF_VAR_B2_S3_ACCESS_KEY:-}}"
-    export B2_S3_SECRET_KEY="${B2_S3_SECRET_KEY:-${TF_VAR_B2_S3_SECRET_KEY:-}}"
-    : "${B2_S3_ACCESS_KEY:?set B2_S3_ACCESS_KEY or TF_VAR_B2_S3_ACCESS_KEY}"
-    : "${B2_S3_SECRET_KEY:?set B2_S3_SECRET_KEY or TF_VAR_B2_S3_SECRET_KEY}"
-    : "${PGPASS:?set PGPASS}"
-    secret_args=(
-      --secret id=b2_access,env=B2_S3_ACCESS_KEY
-      --secret id=b2_secret,env=B2_S3_SECRET_KEY
-      --secret id=pgpass,env=PGPASS
-    )
-    # GITHUB_PAT is optional (raises the GitHub API rate limit); pass only if set.
-    if [ -n "${GITHUB_PAT:-}" ]; then
-      secret_args+=(--secret id=github_pat,env=GITHUB_PAT)
-    fi
+    : "${B2_S3_ACCESS_KEY:?set B2_S3_ACCESS_KEY in your environment}"
+    : "${B2_S3_SECRET_KEY:?set B2_S3_SECRET_KEY in your environment}"
+    : "${PGPASS:?set PGPASS in your environment}"
+    : "${GITHUB_PAT:=}"
     echo "Dispatching build of {{ package }} ({{ versions }}) on {{ os }}:{{ tag }}/{{ arch }} (R {{ r_version }}) to builder '$builder'"
     docker buildx build \
       --builder "$builder" \
       --platform "linux/{{ arch }}" \
       --no-cache \
       --output type=cacheonly \
-      "${secret_args[@]}" \
+      --secret id=b2_access,env=B2_S3_ACCESS_KEY \
+      --secret id=b2_secret,env=B2_S3_SECRET_KEY \
+      --secret id=pgpass,env=PGPASS \
+      --secret id=github_pat,env=GITHUB_PAT \
       --build-arg OS="{{ os }}" \
       --build-arg OS_VERSION="{{ tag }}" \
       --build-arg R_VERSION="{{ r_version }}" \