diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index 8ebfa1d83..b682b6890 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -5,10 +5,13 @@ name: Hash Bags Android build
 # - PRs targeting dev/main (gate merges)
 # - manual via workflow_dispatch
 on:
+  # PR-from-fork triggers strip secrets in Gitea (and GitHub) for security.
+  # We mirror github-such-software/hash-wallet → Builds/hash-wallet via PRs,
+  # so a pull_request trigger here would always run without secrets.
+  # Listen only to push events on the destination branch (post-merge) so
+  # secrets are reliably available.
   push:
     branches: [dev, main]
-  pull_request:
-    branches: [dev, main]
   workflow_dispatch:
 
 concurrency:
@@ -189,8 +192,19 @@ jobs:
           ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
           set -e
+          # Debug visibility — prints lengths only, never values. If a secret
+          # length is 0, Gitea Actions is not passing it to this run (most
+          # commonly because the run was triggered by a from-fork PR).
+          echo "ANDROID_KEYSTORE_BASE64 length: ${#ANDROID_KEYSTORE_BASE64}"
+          echo "ANDROID_KEYSTORE_PASSWORD length: ${#ANDROID_KEYSTORE_PASSWORD}"
+          echo "ANDROID_KEY_ALIAS length: ${#ANDROID_KEY_ALIAS}"
+          echo "ANDROID_KEY_PASSWORD length: ${#ANDROID_KEY_PASSWORD}"
           if [[ -z "$ANDROID_KEYSTORE_BASE64" ]]; then
-            echo "FATAL: ANDROID_KEYSTORE_BASE64 not set — configure Gitea Actions secrets first"
+            echo "FATAL: ANDROID_KEYSTORE_BASE64 not reaching the runner."
+            echo "Check: (1) secret is in repo Settings → Actions → Secrets;"
+            echo "       (2) workflow was triggered by 'push' or 'workflow_dispatch'"
+            echo "           (PR triggers from a fork strip secrets);"
+            echo "       (3) Gitea's runner is configured to pass secrets."
             exit 1
           fi
           # Write decoded keystore next to build.gradle (storeFile path
diff --git a/.github/workflows/build-ios-sim.yml b/.github/workflows/build-ios-sim.yml
index 104627faa..6be9bafe6 100644
--- a/.github/workflows/build-ios-sim.yml
+++ b/.github/workflows/build-ios-sim.yml
@@ -8,10 +8,9 @@ name: Hash Bags iOS Simulator build
 # Phase 2 (separate workflow): full TestFlight pipeline with signing.
 
 on:
+  # See note in build-android.yml about Gitea PR-from-fork secret stripping.
   push:
     branches: [dev, main]
-  pull_request:
-    branches: [dev, main]
   workflow_dispatch:
 
 # Cancel in-flight runs when a newer commit lands on the same branch — so a
diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index 2aaba566a..e8422c0ef 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -5,10 +5,12 @@ name: Hash Bags Linux build
 # - on PRs targeting dev/main (gates merges)
 # - manual via workflow_dispatch ("Run workflow" button in the UI)
 on:
+  # See note in build-android.yml about pull_request vs push triggers and
+  # Gitea Actions' from-fork secret stripping. Push-only here too for
+  # consistency (no secrets are required for Linux build today, but if we
+  # add any in future this avoids surprises).
   push:
     branches: [dev, main]
-  pull_request:
-    branches: [dev, main]
   workflow_dispatch:
 
 concurrency: