diff --git a/.circleci/config.yml b/.circleci/config.yml
index 96dfd40..e435fc7 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -12,17 +12,18 @@ jobs:
           name: Route Bundler through the Socket Firewall registry
           command: |
             set -euo pipefail
-            if [ -z "${SOCKET_GEM_URL:-}" ]; then
+            if [ -z "${SOCKET_FIREWALL_TOKEN:-}" ]; then
               # CircleCI does not share context credentials with forked PRs, so a
               # fork cannot be routed. Say so rather than failing the contributor.
               if [ -n "${CIRCLE_PR_REPONAME:-}" ]; then
                 echo "Forked PR: no Socket Firewall credentials available, gems will come from rubygems.org."
                 exit 0
               fi
-              echo "FATAL: SOCKET_GEM_URL is required (provided by the socket-firewall context)"
+              echo "FATAL: SOCKET_FIREWALL_TOKEN is required (provided by the muster-dev-secrets context)"
               exit 1
             fi
-            bundle config set --global mirror.https://rubygems.org "$SOCKET_GEM_URL"
+            bundle config set --global mirror.https://rubygems.org https://socket-firewall-registry.corporate.intercom.io/rubygems
+            bundle config set --global socket-firewall-registry.corporate.intercom.io "intercom-socket:${SOCKET_FIREWALL_TOKEN}"
             bundle config get mirror.https://rubygems.org | grep -q socket-firewall-registry \
               || { echo "FAIL: bundler mirror not pointing at Socket Firewall"; exit 1; }
       - run: bundle install
@@ -33,4 +34,4 @@ workflows:
     jobs:
       - build:
           context:
-            - socket-firewall
+            - muster-dev-secrets