diff --git a/add-app.sh b/add-app.sh
index 3a69dd3..ea1da45 100755
--- a/add-app.sh
+++ b/add-app.sh
@@ -25,8 +25,12 @@ REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 # Load secrets from credentials file if present
 CREDS_FILE=/root/hotel-manage-credentials.txt
 if [[ -f "$CREDS_FILE" ]]; then
-  # shellcheck disable=SC1090
-  set -a; source <(grep -v '^#' "$CREDS_FILE" | grep '='); set +a
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    [[ "$line" =~ ^[[:space:]]*# ]] && continue
+    [[ -z "${line//[[:space:]]/}" ]] && continue
+    [[ "$line" =~ ^([A-Za-z_][A-Za-z0-9_]*)=(.*)$ ]] || continue
+    export "${BASH_REMATCH[1]}"="${BASH_REMATCH[2]}"
+  done < "$CREDS_FILE"
 fi
 
 # ── Collect config ────────────────────────────────────────────────────────────
diff --git a/apps/cashup.sh b/apps/cashup.sh
index c02db29..2b79311 100755
--- a/apps/cashup.sh
+++ b/apps/cashup.sh
@@ -43,8 +43,13 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd || echo /tm
 CREDS_FILE=/root/hotel-manage-credentials.txt
 [[ -f "$CREDS_FILE" ]] || msg_error "Stack credentials not found at ${CREDS_FILE} — run install-stack.sh first"
 
-# shellcheck disable=SC1090
-set -a; source <(grep -v '^#' "$CREDS_FILE" | grep '='); set +a
+# Read credentials — split on first = only so values with spaces (e.g. SITE_NAME=Hotel Number Four) work correctly
+while IFS= read -r line || [[ -n "$line" ]]; do
+  [[ "$line" =~ ^[[:space:]]*# ]] && continue
+  [[ -z "${line//[[:space:]]/}" ]] && continue
+  [[ "$line" =~ ^([A-Za-z_][A-Za-z0-9_]*)=(.*)$ ]] || continue
+  export "${BASH_REMATCH[1]}"="${BASH_REMATCH[2]}"
+done < "$CREDS_FILE"
 
 [[ -z "${CENTRAL_AUTH_SECRET:-}" ]] && msg_error "CENTRAL_AUTH_SECRET missing from ${CREDS_FILE}"