diff --git a/plugin.sh b/plugin.sh
index d5acd3d..84c0879 100755
--- a/plugin.sh
+++ b/plugin.sh
@@ -9,8 +9,12 @@ PLUGIN_USER=${PLUGIN_USER:-drone}
 
 generate_secrets() {
   echo "--- start secrets ---"
-  docker run --rm -v "${PWD}":/workdir mikefarah/yq ls
-  for SECRET in $(docker run --rm -v "${PWD}":/workdir mikefarah/yq yq r "$PLUGIN_COMPOSE" 'secrets.*.name'); do 
+  # FIXME 3wc: use the yq docker image instead; couldn't easily get it working
+  VERSION=3.4.0
+  BINARY=yq_linux_amd64
+  wget https://github.com/mikefarah/yq/releases/download/${VERSION}/${BINARY} -O /usr/bin/yq &&\
+    chmod +x /usr/bin/yq
+  for SECRET in $(yq r "$PLUGIN_COMPOSE" 'secrets.*.name'); do 
     eval "echo \"generating $SECRET\""
     PW=$(</dev/urandom tr -dc 'A-Za-z0-9' | head -c 40; echo)
     eval "echo \"$PW\" | docker secret create \"$SECRET\" -";