diff --git a/.woodpecker/migrate-tfstate.yml b/.woodpecker/migrate-tfstate.yml
index 38e15ba3..d6903059 100644
--- a/.woodpecker/migrate-tfstate.yml
+++ b/.woodpecker/migrate-tfstate.yml
@@ -38,25 +38,30 @@ steps:
       HETZNER_SECRET:
         from_secret: hetzner_s3_secret_key
     commands:
-      - set -eu
-      - echo "### 1/4 init Garage (source) + pull the live state ###"
-      - tofu init -upgrade -backend-config="access_key=$GARAGE_ACCESS" -backend-config="secret_key=$GARAGE_SECRET"
-      - tofu state pull > /tmp/state.json
-      - BYTES=$(wc -c < /tmp/state.json); echo "pulled state: $BYTES bytes"
-      - test "$BYTES" -gt 2000
-      - RES=$(grep -c '"type":' /tmp/state.json || true); echo "resource entries: $RES"
-      - test "$RES" -gt 10
-      - echo "### 2/4 repoint the backend block to Hetzner (checkout only) ###"
-      - sed -i 's#https://s3.nas-1.renner.uno#https://fsn1.your-objectstorage.com#' providers.tf
-      - sed -i 's#bucket  *= *"tfstate"#bucket = "renner-uno-tfstate"#' providers.tf
-      - sed -i 's#region  *= *"garage"#region = "fsn1"#' providers.tf
-      - sed -i 's#use_path_style  *= *true#use_path_style = false#' providers.tf
-      - grep -E 'bucket|key|endpoint|region|use_path_style' providers.tf
-      - echo "### 3/4 reconfigure to Hetzner (target) + push ###"
-      - tofu init -reconfigure -backend-config="access_key=$HETZNER_ACCESS" -backend-config="secret_key=$HETZNER_SECRET"
-      - tofu state push /tmp/state.json
-      - echo "### 4/4 verify state now lives on Hetzner ###"
-      - tofu state list > /tmp/list.txt
-      - 'echo "migrated resources: $(wc -l < /tmp/list.txt)"'
-      - test "$(wc -l < /tmp/list.txt)" -gt 10
-      - head -20 /tmp/list.txt
+      - |
+        set -eu
+        echo "### 1/4 init Garage source and pull the live state"
+        tofu init -upgrade -backend-config="access_key=$GARAGE_ACCESS" -backend-config="secret_key=$GARAGE_SECRET"
+        tofu state pull > /tmp/state.json
+        BYTES=$(wc -c < /tmp/state.json)
+        echo "pulled state bytes $BYTES"
+        test "$BYTES" -gt 2000
+        RES=$(grep -c '"type"' /tmp/state.json || true)
+        echo "resource entries $RES"
+        test "$RES" -gt 10
+
+        echo "### 2/4 repoint the backend block to Hetzner (checkout only)"
+        sed -i 's#https://s3.nas-1.renner.uno#https://fsn1.your-objectstorage.com#' providers.tf
+        sed -i 's#bucket  *= *"tfstate"#bucket = "renner-uno-tfstate"#' providers.tf
+        sed -i 's#region  *= *"garage"#region = "fsn1"#' providers.tf
+        sed -i 's#use_path_style  *= *true#use_path_style = false#' providers.tf
+        grep -E 'bucket|key|endpoint|region|use_path_style' providers.tf
+
+        echo "### 3/4 reconfigure to Hetzner target and push"
+        tofu init -reconfigure -backend-config="access_key=$HETZNER_ACCESS" -backend-config="secret_key=$HETZNER_SECRET"
+        tofu state push /tmp/state.json
+
+        echo "### 4/4 verify state now lives on Hetzner"
+        tofu state list | tee /tmp/list.txt
+        echo "migrated resource count $(wc -l < /tmp/list.txt)"
+        test "$(wc -l < /tmp/list.txt)" -gt 10