diff --git a/.woodpecker.yml b/.woodpecker.yml
index 55235a6..c4bc4c7 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -26,11 +26,25 @@ matrix:
     - cron
 
 steps:
+  - name: validate-registry-secrets
+    image: registry.nxtgauge.com/alpine:3.20
+    environment:
+      REGISTRY_HOSTPORT:
+        from_secret: REGISTRY_HOSTPORT
+      REGISTRY_USERNAME:
+        from_secret: REGISTRY_USERNAME
+      REGISTRY_PASSWORD:
+        from_secret: REGISTRY_PASSWORD
+    commands:
+      - test -n "${REGISTRY_HOSTPORT:-}" || (echo "missing REGISTRY_HOSTPORT" && exit 1)
+      - test -n "${REGISTRY_USERNAME:-}" || (echo "missing REGISTRY_USERNAME" && exit 1)
+      - test -n "${REGISTRY_PASSWORD:-}" || (echo "missing REGISTRY_PASSWORD" && exit 1)
+      - test "${REGISTRY_HOSTPORT}" = "registry.nxtgauge.com" || (echo "REGISTRY_HOSTPORT must be registry.nxtgauge.com (got: ${REGISTRY_HOSTPORT})" && exit 1)
+
   - name: build-and-push
     image: registry.nxtgauge.com/kaniko:2.1.1
     settings:
-      registry:
-        from_secret: REGISTRY_HOSTPORT
+      registry: registry.nxtgauge.com
       username:
         from_secret: REGISTRY_USERNAME
       password:
@@ -50,11 +64,25 @@ when:
   event: push
 
 steps:
+  - name: validate-registry-secrets
+    image: registry.nxtgauge.com/alpine:3.20
+    environment:
+      REGISTRY_HOSTPORT:
+        from_secret: REGISTRY_HOSTPORT
+      REGISTRY_USERNAME:
+        from_secret: REGISTRY_USERNAME
+      REGISTRY_PASSWORD:
+        from_secret: REGISTRY_PASSWORD
+    commands:
+      - test -n "${REGISTRY_HOSTPORT:-}" || (echo "missing REGISTRY_HOSTPORT" && exit 1)
+      - test -n "${REGISTRY_USERNAME:-}" || (echo "missing REGISTRY_USERNAME" && exit 1)
+      - test -n "${REGISTRY_PASSWORD:-}" || (echo "missing REGISTRY_PASSWORD" && exit 1)
+      - test "${REGISTRY_HOSTPORT}" = "registry.nxtgauge.com" || (echo "REGISTRY_HOSTPORT must be registry.nxtgauge.com (got: ${REGISTRY_HOSTPORT})" && exit 1)
+
   - name: build-and-push-migrate
     image: registry.nxtgauge.com/kaniko:2.1.1
     settings:
-      registry:
-        from_secret: REGISTRY_HOSTPORT
+      registry: registry.nxtgauge.com
       username:
         from_secret: REGISTRY_USERNAME
       password: