diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 398c2bfcd..769418a46 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -31,7 +31,7 @@ jobs:
         run: npm run build:storybook
         env:
           NODE_OPTIONS: --max_old_space_size=4096
-          VITE_APP_GOOGLE_MAPS_API_KEY: ${{ vars.GOOGLE_MAPS_API_KEY }}
+          VITE_APP_GOOGLE_MAPS_API_KEY: ${{ secrets.GOOGLE_MAPS_API_KEY }}
 
       - name: Deploy to GitHub Pages
         uses: JamesIves/github-pages-deploy-action@v4
diff --git a/CHANGELOG.mdx b/CHANGELOG.mdx
index fb5e6346f..1d49b41c3 100644
--- a/CHANGELOG.mdx
+++ b/CHANGELOG.mdx
@@ -17,6 +17,11 @@ Prefix the change with one of these keywords:
 
 ## [Unreleased]
 
+### Security
+
+- Rotated leaked Google Maps API key and moved to GitHub Secrets
+- Fixed incorrect env var in `LocationPicker` component
+
 ### Added
 
 - Circle dollar icon
diff --git a/lib/components/LocationPicker/LocationPicker.tsx b/lib/components/LocationPicker/LocationPicker.tsx
index 63e934847..de71f3dff 100644
--- a/lib/components/LocationPicker/LocationPicker.tsx
+++ b/lib/components/LocationPicker/LocationPicker.tsx
@@ -20,7 +20,7 @@ export function LocationPicker({ address, markerCallback }: ILocationPickerProps
   const inputRef = useRef<HTMLInputElement | null>(null)
 
   const { isLoaded } = useJsApiLoader({
-    googleMapsApiKey: import.meta.env.VITE_GOOGLE_MAPS_API_KEY,
+    googleMapsApiKey: import.meta.env.VITE_APP_GOOGLE_MAPS_API_KEY,
     libraries,
   })