diff --git a/datasette/publish/heroku.py b/datasette/publish/heroku.py
index 085e6c3a..ae08f916 100644
--- a/datasette/publish/heroku.py
+++ b/datasette/publish/heroku.py
@@ -62,6 +62,30 @@ def publish_subcommand(publish):
             )
             call(["heroku", "plugins:install", "heroku-builds"])
 
+        extra_metadata = {
+            "title": title,
+            "license": license,
+            "license_url": license_url,
+            "source": source,
+            "source_url": source_url,
+            "about": about,
+            "about_url": about_url,
+        }
+
+        environment_variables = {}
+        if plugin_secret:
+            extra_metadata["plugins"] = {}
+            for plugin_name, plugin_setting, setting_value in plugin_secret:
+                environment_variable = (
+                    "{}_{}".format(plugin_name, plugin_setting)
+                    .upper()
+                    .replace("-", "_")
+                )
+                environment_variables[environment_variable] = setting_value
+                extra_metadata["plugins"].setdefault(plugin_name, {})[
+                    plugin_setting
+                ] = {"$env": environment_variable}
+
         with temporary_heroku_directory(
             files,
             name,
@@ -73,15 +97,7 @@ def publish_subcommand(publish):
             static,
             install,
             version_note,
-            {
-                "title": title,
-                "license": license,
-                "license_url": license_url,
-                "source": source,
-                "source_url": source_url,
-                "about": about,
-                "about_url": about_url,
-            },
+            extra_metadata,
         ):
             app_name = None
             if name:
@@ -105,6 +121,9 @@ def publish_subcommand(publish):
                 create_output = check_output(cmd).decode("utf8")
                 app_name = json.loads(create_output)["name"]
 
+            for key, value in environment_variables.items():
+                call(["heroku", "config:set", "-a", app_name, "{}={}".format(key, value)])
+
             call(["heroku", "builds:create", "-a", app_name, "--include-vcs-ignore"])