diff --git a/.cirrus.yml b/.cirrus.yml
index 580552f5a1..ce3a1bfb0f 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -51,7 +51,7 @@ env:
   ZEEK_CI_CONFIGURE_FLAGS: *CONFIG
   # This is a single-purpose, read-only GitHub deploy key (SSH private key) for
   # the zeek-testing-private repository.
-  ZEEK_TESTING_PRIVATE_SSH_KEY: ENCRYPTED[6631d7bf11e6553c531222953fb6de4d4a48a86a5dbc21a97604d5ca1791845718c985d9086f125cead6908e1b5f2b23]
+  ZEEK_TESTING_PRIVATE_SSH_KEY: ENCRYPTED[!dbdba93df9c166f926480cebff52dab303589257b3b3ee53aa392021aff2881ed9aafefef26aa9a1b71a49d663d1361c!]
 
 # Linux EOL timelines: https://linuxlifecycle.com/
 # Fedora (~13 months): https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle
diff --git a/ci/README b/ci/README
index 1d138437eb..146a90e71f 100644
--- a/ci/README
+++ b/ci/README
@@ -19,10 +19,10 @@ purpose SSH key with read-only permissions.  Here's how it can be set up:
 2. Add contents of ``cirrus-key.pub`` as a new key on GitHub:
    https://github.com/zeek/zeek-testing-private/settings/keys
 
-3. Generate a new Cirrus CI secured variable in the repository settings at
-   https://cirrus-ci.com/github/zeek/zeek.  The value of the secured variable
-   is the base64-encoded private key, and can be obtained from the output of
-   the command: ``base64 cirrus-key``.
+3. Generate a new Orgnaization-Level Secured Variable in Cirrus CI settings at
+   https://cirrus-ci.com/settings/github/zeek.  The value of the secured
+   variable is the base64-encoded private key, and can be obtained from the
+   output of the command: ``base64 cirrus-key``.
 
 4. Take the ``ENCRYPTED[...]``` string generated by Cirrus and use that as the
    value of ``ZEEK_TESTING_PRIVATE_SSH_KEY`` in ``.cirrus.yml``