diff --git a/.ci/compose.cypress.yaml b/.ci/compose.cypress.yaml
index ea65a8cdf5..f2fb4ce676 100644
--- a/.ci/compose.cypress.yaml
+++ b/.ci/compose.cypress.yaml
@@ -78,4 +78,4 @@ services:
       POSTGRES_HOST_AUTH_METHOD: "trust"
 secrets:
   npmrc:
-    file: ${HOME}/.npmrc
+    environment: NPMRC
diff --git a/justfile b/justfile
index 56e4c40058..39d1bfc8ee 100644
--- a/justfile
+++ b/justfile
@@ -76,6 +76,10 @@ e2e-test: cleanup-e2e-test
 	export COMPOSE_PROJECT_NAME=cypress
 	export COMPOSE_DOCKER_CLI_BUILD=1
 	export DOCKER_BUILDKIT=1
+	# Passed as an environment secret: bake refuses file secrets outside the
+	# repo, and Compose does not grant it fs.read for them.
+	NPMRC=$(< ~/.npmrc)
+	export NPMRC
 
 	echo "Building Cypress environment..."
 	yarn cypress build