diff --git a/.gitea/workflows/domestic-test.yml b/.gitea/workflows/domestic-test.yml
index 90031236..51a2201e 100644
--- a/.gitea/workflows/domestic-test.yml
+++ b/.gitea/workflows/domestic-test.yml
@@ -21,17 +21,17 @@ jobs:
         env:
           SSH_HOST: ${{ secrets.DOMESTIC_TEST_SSH_HOST }}
           SSH_PORT: ${{ secrets.DOMESTIC_TEST_SSH_PORT }}
-          SSH_PRIVATE_KEY: ${{ secrets.DOMESTIC_TEST_SSH_PRIVATE_KEY }}
+          SSH_PRIVATE_KEY_B64: ${{ secrets.DOMESTIC_TEST_SSH_PRIVATE_KEY_B64 }}
           SSH_KNOWN_HOSTS: ${{ secrets.DOMESTIC_TEST_SSH_KNOWN_HOSTS }}
         run: |
           set -eu
-          if [ -z "$SSH_HOST" ] || [ -z "$SSH_PRIVATE_KEY" ] || [ -z "$SSH_KNOWN_HOSTS" ]; then
+          if [ -z "$SSH_HOST" ] || [ -z "$SSH_PRIVATE_KEY_B64" ] || [ -z "$SSH_KNOWN_HOSTS" ]; then
             echo "Missing domestic test SSH secrets" >&2
             exit 1
           fi
           mkdir -p "$HOME/.ssh"
           chmod 700 "$HOME/.ssh"
-          printf '%s\n' "$SSH_PRIVATE_KEY" > "$HOME/.ssh/domestic_test_deploy_key"
+          printf '%s' "$SSH_PRIVATE_KEY_B64" | base64 -d > "$HOME/.ssh/domestic_test_deploy_key"
           printf '%s\n' "$SSH_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
           chmod 600 "$HOME/.ssh/domestic_test_deploy_key" "$HOME/.ssh/known_hosts"
 
diff --git a/scripts/contracts/__tests__/domestic-test-workflow.test.mjs b/scripts/contracts/__tests__/domestic-test-workflow.test.mjs
index 920f3cbf..cec6cdad 100644
--- a/scripts/contracts/__tests__/domestic-test-workflow.test.mjs
+++ b/scripts/contracts/__tests__/domestic-test-workflow.test.mjs
@@ -18,7 +18,8 @@ test("domestic frontend workflow is manual and registry-free", async () => {
   assert.doesNotMatch(workflow, /\bpush:/);
   assert.doesNotMatch(workflow, /REGISTRY_IMAGE/);
   assert.match(workflow, /docker save/);
-  assert.match(workflow, /DOMESTIC_TEST_SSH_PRIVATE_KEY/);
+  assert.match(workflow, /DOMESTIC_TEST_SSH_PRIVATE_KEY_B64/);
+  assert.match(workflow, /base64 -d/);
 });
 
 test("domestic frontend workflow pins the China test API and isolated port", async () => {