diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index a0fdd27..74964db 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -75,7 +75,7 @@ stages:
         --azure-key-vault-certificate "$(SignKeyVaultCertificate)" `
         --azure-key-vault-url "$(SignKeyVaultUrl)"
       env:
-        SignClientSecret: $(SignClientSecret)
+        SignClientSecret: $[ variablegroups.SignTool-DNF.SignClientSecret ]
       displayName: Sign packages
 
     - publish: $(Pipeline.Workspace)/BuildPackages