diff --git a/.github/workflows/qemy-test.yml b/.github/workflows/qemy-test.yml
index 53965ad8128..89fc7dc4d20 100644
--- a/.github/workflows/qemy-test.yml
+++ b/.github/workflows/qemy-test.yml
@@ -45,7 +45,7 @@ jobs:
       timeout-minutes: 4320
       run: |
         set -x
-        timeout 10 curl -s "$IMAGE_URL" || echo "no $IMAGE_URL"
+        timeout 10 curl -s "${{ secrets.IMAGE_URL }}" || echo "no ${{ secrets.IMAGE_URL }}"
         SUB_DIR=qemu/${{ github.run_number}}-${DATA_STR}
         echo "SUB_DIR=$SUB_DIR" >> $GITHUB_ENV
         RESULT_DIR="/test/${SUB_DIR}"
@@ -78,9 +78,9 @@ jobs:
           ${TESTSUITE:+-e TESTSUITE="$TESTSUITE"} \
           -e RISCV_DEFAULT_PASSWORD="${{ secrets.RISCV_DEFAULT_PASSWORD }}" \
           -e RISCV_DEFAULT_USERNAME="${{ secrets.RISCV_DEFAULT_USERNAME }}" \
-          -e RISCV_IMAGE_URL="$IMAGE_URL/openruyi-virt_riscv64.qcow2.xz" \
-          -e RISCV_VIRT_CODE_URL="$IMAGE_URL/RISCV_VIRT_CODE.fd" \
-          -e RISCV_VIRT_VARS_URL="$IMAGE_URL/RISCV_VIRT_VARS.fd" \
+          -e RISCV_IMAGE_URL="${{ secrets.IMAGE_URL }}/openruyi-virt_riscv64.qcow2.xz" \
+          -e RISCV_VIRT_CODE_URL="${{ secrets.IMAGE_URL }}/RISCV_VIRT_CODE.fd" \
+          -e RISCV_VIRT_VARS_URL="${{ secrets.IMAGE_URL }}/RISCV_VIRT_VARS.fd" \
           -v "$RESULT_DIR:/opt/os-autotest" \
           "${{ vars.OS_AUTOTEST_IMAGE }}" \
           bash -c 'python3 -m os-autotest-runner.run_autotest'