diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index 81b3f9932..34c0577dc 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -237,9 +237,11 @@ jobs:
         run: flutter build apk --dart-define-from-file=env.json --release
 
       # AAB for Play Console upload (Google generates per-ABI APKs server-side
-      # via Play App Signing).
+      # via Play App Signing). --verbose surfaces the full gradle stacktrace
+      # when FinalizeBundleTask / signReleaseBundle fails — without it the
+      # error is opaque ('FinalizeBundleTask$BundleToolRunnable failed').
       - name: Build release AAB
-        run: flutter build appbundle --dart-define-from-file=env.json --release
+        run: flutter build appbundle --dart-define-from-file=env.json --release --verbose
 
       - name: Sanity-check signature on APK
         run: |
diff --git a/.github/workflows/build-ios-sim.yml b/.github/workflows/build-ios-sim.yml
index ea60e50b4..935744161 100644
--- a/.github/workflows/build-ios-sim.yml
+++ b/.github/workflows/build-ios-sim.yml
@@ -32,6 +32,14 @@ jobs:
       # Gitea runner shell). Force UTF-8 globally so `pod install` succeeds.
       LANG: en_US.UTF-8
       LC_ALL: en_US.UTF-8
+      # The Mac runner hits git.such.software via the LAN (NAT hairpin),
+      # which bypasses the Let's Encrypt-fronted NPM and lands on Gitea's
+      # internal self-signed cert. Node won't trust it, so artifact upload
+      # bails with DEPTH_ZERO_SELF_SIGNED_CERT. Acceptable to skip
+      # validation since we're talking to our own infrastructure on our LAN.
+      # Long-term fix: point the runner at git.such.software via the public
+      # IP / NPM cert OR install Gitea's CA into the runner's trust store.
+      NODE_TLS_REJECT_UNAUTHORIZED: '0'
 
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml
index f7be36a57..2a0b8f8aa 100644
--- a/.github/workflows/build-ios-testflight.yml
+++ b/.github/workflows/build-ios-testflight.yml
@@ -38,6 +38,10 @@ jobs:
       # CocoaPods needs UTF-8; Gitea runner shell defaults to ASCII-8BIT.
       LANG: en_US.UTF-8
       LC_ALL: en_US.UTF-8
+      # Mac runner hits internal Gitea over LAN (NAT hairpin), bypassing
+      # the public Let's Encrypt cert. Skip TLS verification for the
+      # artifact upload — talking to our own server on our own network.
+      NODE_TLS_REJECT_UNAUTHORIZED: '0'
 
     steps:
       - uses: actions/checkout@v4