diff --git a/README.md b/README.md
index b00a6b2..18ce2e6 100644
--- a/README.md
+++ b/README.md
@@ -10,8 +10,8 @@ projects, in the same spirit as [tic80-tools](../tic80-tools).
   `ci-binaries`, `ci-upload`, `ci-update`).
 - `example-woodpecker.yaml` — Woodpecker pipeline: version → export
   (Go, `GOOS=js GOARCH=wasm`) → binaries (native desktop zips) →
-  upload (scp to the droparea) → update (calls the teletypegames
-  `/update` endpoint with `platform=ebitengine`).
+  upload (HTTP POST to `/build/upload`) → update (calls the teletypegames
+  `/build/publish` endpoint with `platform=ebitengine`).
 - `example-tasks.json` — VS Code `.vscode/tasks.json` with the common
   dev tasks: **Run** (`go run .`, default build task, `Cmd+Shift+B`),
   **Build & Run**, **Build WASM** and **Make build**.
@@ -23,14 +23,14 @@ projects, in the same spirit as [tic80-tools](../tic80-tools).
 1. Copy `example-makefile.make` to `Makefile` and set `PROJECT`
    (the native binary is built to `bin/$(PROJECT)`).
 2. Copy `example-woodpecker.yaml` to `.woodpecker.yaml` and add the
-   `droparea_ssh_password` / `update_secret_key` secrets in Woodpecker.
+   `update_secret_key` secret in Woodpecker.
 3. Copy `example-tasks.json` to `.vscode/tasks.json` and replace the
    binary name (`ebitenginedemo`) with `$(PROJECT)`.
 
 The pipeline uploads `$(PROJECT)-$(VERSION).html.zip` plus the native
 binary zips (`$(PROJECT)-$(VERSION)-<target>.zip`, currently `win-x86`,
-`win-x64`, `linux-x64`) to the droparea, then triggers
-`/update?platform=ebitengine&name=$(PROJECT)&version=$(VERSION)`.
+`win-x64`, `linux-x64`) via `/build/upload`, then triggers
+`/build/publish?platform=ebitengine&name=$(PROJECT)&version=$(VERSION)`.
 The updater picks up the binary zips by naming convention and attaches
 them to the release as assets (see `teletypegames/NOTES_BINARY_PLAN.md`).
 
@@ -47,12 +47,11 @@ They are built **on a mac host** instead, packaged as a minimal
 `.app` bundle (generated Info.plist, ad-hoc `codesign`):
 
 ```sh
-make mac-release VERSION=x.y.z \
-  DROPAREA_SSH_PASSWORD=... UPDATE_SECRET=...
+make mac-release VERSION=x.y.z UPDATE_SECRET=...
 ```
 
-This builds both mac zips, uploads them to the droparea and re-triggers
-`/update` — the updater attaches the new assets to the already existing
+This builds both mac zips, uploads them via `/build/upload` and re-triggers
+`/build/publish` — the updater attaches the new assets to the already existing
 release, so run it after the CI pipeline has created the release.
 Ad-hoc signature means Gatekeeper shows the "unidentified developer"
 warning (right-click → Open); proper signing/notarization needs an
diff --git a/example-makefile.make b/example-makefile.make
index ce41384..02b1fee 100644
--- a/example-makefile.make
+++ b/example-makefile.make
@@ -16,10 +16,6 @@ VERSION_FILE = .version
 INDEX_HTML_URL = https://git.teletypegames.org/tools/ebitengine-tools/raw/branch/master/web/index.html
 
 # a mac-release lokális futtatásához (CI-ban a woodpecker env adja ugyanezeket)
-DROPAREA_HOST        ?= vps.teletype.hu
-DROPAREA_PORT        ?= 2223
-DROPAREA_USER        ?= drop
-DROPAREA_TARGET_PATH ?= /home/drop
 UPDATE_SERVER        ?= https://teletypegames.org
 
 all: build
@@ -88,15 +84,17 @@ binary-mac-x64:
 binary-mac-arm64:
 	@$(MAKE) binary-build-mac VERSION=$(VERSION) B_GOARCH=arm64 B_TARGET=mac-arm64
 
-# macről futtatandó: felépíti mindkét mac zipet, feltölti a dropareába, majd
-# meghívja az /update-et, ami a meglévő release-hez hozzáfűzi az asseteket
+# macről futtatandó: felépíti mindkét mac zipet, feltölti a /build/upload-dal,
+# majd a /build/publish hozzáfűzi az asseteket a meglévő release-hez
 mac-release: binaries-mac
 	@FILES=""; \
 	for target in $(MAC_TARGETS); do FILES="$$FILES $(PROJECT)-$(VERSION)-$$target.zip"; done; \
-	sshpass -p "$(DROPAREA_SSH_PASSWORD)" scp -o StrictHostKeyChecking=no -P $(DROPAREA_PORT) \
-		$$FILES \
-		$(DROPAREA_USER)@$(DROPAREA_HOST):$(DROPAREA_TARGET_PATH)/; \
-	curl "$(UPDATE_SERVER)/update?secret=$(UPDATE_SECRET)&name=$(PROJECT)&platform=ebitengine&version=$(VERSION)"
+	for f in $$FILES; do \
+		curl -fsS -H "X-Update-Secret: $(UPDATE_SECRET)" \
+			-F "file=@$$f" \
+			"$(UPDATE_SERVER)/build/upload?name=$(PROJECT)&version=$(VERSION)" || exit 1; \
+	done; \
+	curl -fsS -X POST -H "X-Update-Secret: $(UPDATE_SECRET)" "$(UPDATE_SERVER)/build/publish?name=$(PROJECT)&platform=ebitengine&version=$(VERSION)"
 
 # belső helper: egy target buildje + zip egyetlen gyökérmappával
 # (a zipet unixos zip készíti, így a végrehajtási bit megmarad)
@@ -178,12 +176,14 @@ ci-upload:
 	META_DST="$(PROJECT)-$$VERSION.metadata.json"; \
 	BINS=$$(ls $(PROJECT)-$$VERSION-*.zip 2>/dev/null || true); \
 	cp $$META_SRC $$META_DST; \
-	sshpass -p "$(DROPAREA_SSH_PASSWORD)" scp -o StrictHostKeyChecking=no -P $(DROPAREA_PORT) \
-		$$FILE $$META_DST $$BINS \
-		$(DROPAREA_USER)@$(DROPAREA_HOST):$(DROPAREA_TARGET_PATH)/
+	for f in $$FILE $$META_DST $$BINS; do \
+		curl -fsS -H "X-Update-Secret: $(UPDATE_SECRET)" \
+			-F "file=@$$f" \
+			"$(UPDATE_SERVER)/build/upload?name=$(PROJECT)&version=$$VERSION" || exit 1; \
+	done
 
 ci-update:
 	@VERSION=$$(cat $(VERSION_FILE)); \
-	curl "$(UPDATE_SERVER)/update?secret=$(UPDATE_SECRET)&name=$(PROJECT)&platform=ebitengine&version=$$VERSION"
+	curl -fsS -X POST -H "X-Update-Secret: $(UPDATE_SECRET)" "$(UPDATE_SERVER)/build/publish?name=$(PROJECT)&platform=ebitengine&version=$$VERSION"
 
 .PHONY: all build wasm export watch clean binaries binaries-mac mac-release binary-win-x86 binary-win-x64 binary-linux-x64 binary-mac-x64 binary-mac-arm64 binary-build binary-build-mac ci-version ci-export ci-binaries ci-upload ci-update
\ No newline at end of file
diff --git a/example-woodpecker.yaml b/example-woodpecker.yaml
index 3af495c..f7e0a20 100644
--- a/example-woodpecker.yaml
+++ b/example-woodpecker.yaml
@@ -20,14 +20,11 @@ steps:
   - name: artifact
     image: alpine
     environment:
-      DROPAREA_HOST: vps.teletype.hu
-      DROPAREA_PORT: 2223
-      DROPAREA_TARGET_PATH: /home/drop
-      DROPAREA_USER: drop
-      DROPAREA_SSH_PASSWORD:
-        from_secret: droparea_ssh_password
+      UPDATE_SERVER: https://teletypegames.org
+      UPDATE_SECRET:
+        from_secret: update_secret_key
     commands:
-      - apk add --no-cache make openssh-client sshpass
+      - apk add --no-cache make curl
       - make ci-upload
 
   - name: update