diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index 81b3f993..34c0577d 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -237,9 +237,11 @@ jobs:
         run: flutter build apk --dart-define-from-file=env.json --release
 
       # AAB for Play Console upload (Google generates per-ABI APKs server-side
-      # via Play App Signing).
+      # via Play App Signing). --verbose surfaces the full gradle stacktrace
+      # when FinalizeBundleTask / signReleaseBundle fails — without it the
+      # error is opaque ('FinalizeBundleTask$BundleToolRunnable failed').
       - name: Build release AAB
-        run: flutter build appbundle --dart-define-from-file=env.json --release
+        run: flutter build appbundle --dart-define-from-file=env.json --release --verbose
 
       - name: Sanity-check signature on APK
         run: |
diff --git a/.github/workflows/build-ios-sim.yml b/.github/workflows/build-ios-sim.yml
index ea60e50b..4a0d6fa6 100644
--- a/.github/workflows/build-ios-sim.yml
+++ b/.github/workflows/build-ios-sim.yml
@@ -32,6 +32,12 @@ jobs:
       # Gitea runner shell). Force UTF-8 globally so `pod install` succeeds.
       LANG: en_US.UTF-8
       LC_ALL: en_US.UTF-8
+      # If you added an /etc/hosts entry on the Mac mini that points
+      # git.such.software at NPM's LAN IP (so the runner hits NPM's
+      # Let's Encrypt cert instead of Gitea's internal self-signed),
+      # this env var can be removed. Left in as a belt-and-suspenders
+      # fallback — has no effect if certs already verify.
+      NODE_TLS_REJECT_UNAUTHORIZED: '0'
 
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml
index f7be36a5..51228754 100644
--- a/.github/workflows/build-ios-testflight.yml
+++ b/.github/workflows/build-ios-testflight.yml
@@ -38,6 +38,9 @@ jobs:
       # CocoaPods needs UTF-8; Gitea runner shell defaults to ASCII-8BIT.
       LANG: en_US.UTF-8
       LC_ALL: en_US.UTF-8
+      # See note in build-ios-sim.yml — fallback if /etc/hosts trick
+      # isn't in place. Safe no-op once it is.
+      NODE_TLS_REJECT_UNAUTHORIZED: '0'
 
     steps:
       - uses: actions/checkout@v4