diff --git a/.github/actions/deploy/README.md b/.github/actions/deploy/README.md
index 2e7350f..7216034 100644
--- a/.github/actions/deploy/README.md
+++ b/.github/actions/deploy/README.md
@@ -26,7 +26,7 @@ jobs:
         with:
           message: "Deploy: ${{ matrix.name }} updated"
           telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
+          telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
 ```
 
 Unlike a `workflow_call` reusable workflow, this action doesn't check out anything itself - it reads `target-manifest` from whatever the caller's own preceding `actions/checkout` step already put on disk, and its own code (`deploy.py` and friends) comes along automatically via `$GITHUB_ACTION_PATH` whenever it's referenced as `owner/repo/.github/actions/deploy@ref`. This is also why there's no `target-manifest-ref` input here: if the caller needs a specific ref (e.g. a just-published release tag), it just checks out that ref itself before this step runs, the same way every other job in this repository already does.
diff --git a/.github/actions/renovate/README.md b/.github/actions/renovate/README.md
index 48d2bd5..ba9b602 100644
--- a/.github/actions/renovate/README.md
+++ b/.github/actions/renovate/README.md
@@ -26,7 +26,7 @@ jobs:
         with:
           message: "Renovate: updated on ${{ steps.renovate.outputs.target-name }} (${{ steps.renovate.outputs.updated-hosts }})"
           telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
+          telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
 ```
 
 Not every target runs every requested app - `renovate.py` decides that itself, from the target manifest's own `apps` mapping, and simply does nothing (never opening an SSH connection) if none of the requested apps are present. To tell whether a host's image actually changed (rather than the pull being a no-op), it compares `docker compose images -q` output before and after the pull, and exposes that as this action's own `updated`/`updated-hosts`/`target-name` outputs.
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index cd12eae..c50089b 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -33,4 +33,4 @@ jobs:
         with:
           message: "Deploy: ${{ matrix.name }} updated"
           telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
+          telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
diff --git a/.github/workflows/notify-telegram-pr.yml b/.github/workflows/notify-telegram-pr.yml
index f993dac..b86e9f4 100644
--- a/.github/workflows/notify-telegram-pr.yml
+++ b/.github/workflows/notify-telegram-pr.yml
@@ -7,7 +7,8 @@ on:
   workflow_dispatch:
 jobs:
   notify:
-    uses: rubykatzen/baseline/.github/workflows/notify-telegram-pr-shared.yml@v0.16.2
+    uses: rubykatzen/baseline/.github/workflows/notify-telegram-pr-shared.yml@v0.17.0
+    with:
+      telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
     secrets:
-      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-      TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+      telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
diff --git a/.github/workflows/notify-telegram-release.yml b/.github/workflows/notify-telegram-release.yml
index 002749a..3f3313c 100644
--- a/.github/workflows/notify-telegram-release.yml
+++ b/.github/workflows/notify-telegram-release.yml
@@ -4,7 +4,8 @@ on:
     types: [published]
 jobs:
   notify:
-    uses: rubykatzen/baseline/.github/workflows/notify-telegram-release-shared.yml@v0.16.2
+    uses: rubykatzen/baseline/.github/workflows/notify-telegram-release-shared.yml@v0.17.0
+    with:
+      telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
     secrets:
-      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-      TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+      telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index c7bf2a4..0c4d75b 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -41,4 +41,4 @@ jobs:
         with:
           message: "Renovate: updated on ${{ steps.renovate.outputs.target-name }} (${{ steps.renovate.outputs.updated-hosts }})"
           telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
+          telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
diff --git a/README.md b/README.md
index 2cdc0ff..6e2d5eb 100644
--- a/README.md
+++ b/README.md
@@ -366,7 +366,7 @@ jobs:
         with:
           message: "Deploy: mainframe updated"
           telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
+          telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
 ```
 
 <!-- x-release-please-end -->
@@ -424,7 +424,7 @@ jobs:
         with:
           message: "Renovate: updated on ${{ steps.renovate.outputs.target-name }} (${{ steps.renovate.outputs.updated-hosts }})"
           telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
+          telegram-chat-id: ${{ vars.TELEGRAM_CHAT_ID }}
 ```
 
 `renovate.yml` also runs on a nightly `schedule` (`0 3 * * *`), with `apps` defaulting to `[]` — a cron trigger can't supply `workflow_dispatch` inputs at all, so the empty-array-means-everything behavior above exists specifically to give the scheduled run something to pass.