diff --git a/.gitea/scripts/replaceTokens.js b/.gitea/scripts/replaceTokens.js
new file mode 100644
index 0000000..565cfdb
--- /dev/null
+++ b/.gitea/scripts/replaceTokens.js
@@ -0,0 +1,38 @@
+module.exports = async ({ github, context, core, jobId }) => {
+    
+    const frontendPath = `./${jobId}/frontend/diunaBI/browser/`;
+    const files = (require('fs').readdirSync(frontendPath).filter(file => file.endsWith('.js')))
+        .map(file => `${frontendPath}${file}`);
+    if (files.length === 0) {
+        core.setFailed("Frontend JS files not found");
+        return false;
+    }
+        
+    files.push(`./${jobId}/webapi/appsettings.json`);
+    files.push(`./${jobId}/webapi/client_secrets.json`);
+
+    files.forEach(file => {
+        let data = require('fs').readFileSync(file, 'utf8');
+        const regex = /#{(.*?)}#/g;
+        let match;
+        while (match = regex.exec(data)) {
+            const original = match[0];
+            const token = match[1].replace(/-/g, '_').toUpperCase();
+            const value = getValue(token, jobId);
+            console.log(`Replacing ${original} with ${value} for ${token}`);
+            if (!value) {
+                core.setFailed(`Token ${token} not found`);
+                return false;
+            }
+            data = data.replace(new RegExp(original, 'g'), value);
+        }
+        require('fs').writeFileSync(file, data, 'utf8');
+    });
+}
+
+function getValue(token, jobId) {
+    if (token == 'BUILDID') { return jobId; }
+    const secrets = JSON.parse(process.env.SECRETS);
+    const variables = JSON.parse(process.env.VARIABLES);
+    return variables[token] || secrets[token];
+}
\ No newline at end of file
diff --git a/.gitea/workflows/morskaRelease.yml b/.gitea/workflows/morskaRelease.yml
index 3e9857f..161b96f 100644
--- a/.gitea/workflows/morskaRelease.yml
+++ b/.gitea/workflows/morskaRelease.yml
@@ -62,6 +62,14 @@ jobs:
           ls -laR artifacts/webapi || true
           echo "::endgroup::"
           
+      - name: Tokenize (replace #{...}# from secrets/vars)
+        env:
+          SECRETS: ${{ toJson(secrets) }}
+          VARIABLES: ${{ toJson(vars) }}
+        run: |
+          set -euo pipefail
+          node -e "require('./.gitea/workflows/buildScripts/replaceTokens.js')({ github: {}, context: {}, core: {} });"
+          
       - name: Package artifacts as ZIPs
         run: |
           mkdir -p build