diff --git a/.gitea/workflows/build-apk.yml b/.gitea/workflows/build-apk.yml
index 7cb5c74..82adbda 100644
--- a/.gitea/workflows/build-apk.yml
+++ b/.gitea/workflows/build-apk.yml
@@ -15,8 +15,14 @@ jobs:
 
       - name: Setup keystore and environment
         run: |
-          echo "${{ secrets.KEYSTORE_BASE64 }}" | tr -d '\n' | base64 -d > app/key.jks
-          echo "${{ secrets.DOTENV_BASE64 }}" | tr -d '\n' | base64 -d > .build/release/.env
+          # Keystore is binary, so it must be base64. Strip any whitespace/newlines first.
+          echo "${{ secrets.KEYSTORE_BASE64 }}" | tr -d '[:space:]' | base64 -d > app/key.jks
+          # Write the .env directly from plain secrets (no base64 dotenv to get wrong).
+          {
+            echo "KEYSTORE_PASSWORD=${{ secrets.KEYSTORE_PASSWORD }}"
+            echo "KEY_ALIAS=${{ secrets.KEY_ALIAS }}"
+            echo "KEY_PASSWORD=${{ secrets.KEY_PASSWORD }}"
+          } > .build/release/.env
 
       - name: Build APK
         working-directory: .build/release