diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index b682b6890..a1e566107 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -5,13 +5,9 @@ name: Hash Bags Android build
 # - PRs targeting dev/main (gate merges)
 # - manual via workflow_dispatch
 on:
-  # PR-from-fork triggers strip secrets in Gitea (and GitHub) for security.
-  # We mirror github-such-software/hash-wallet → Builds/hash-wallet via PRs,
-  # so a pull_request trigger here would always run without secrets.
-  # Listen only to push events on the destination branch (post-merge) so
-  # secrets are reliably available.
-  push:
-    branches: [dev, main]
+  # Manual-only for now. Trigger via Actions → "Hash Bags Android build"
+  # → Run workflow when you want a build. workflow_dispatch runs as the
+  # triggering user, so secrets are always available (unlike PR triggers).
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/build-ios-sim.yml b/.github/workflows/build-ios-sim.yml
index 6be9bafe6..f5a934be9 100644
--- a/.github/workflows/build-ios-sim.yml
+++ b/.github/workflows/build-ios-sim.yml
@@ -8,9 +8,8 @@ name: Hash Bags iOS Simulator build
 # Phase 2 (separate workflow): full TestFlight pipeline with signing.
 
 on:
-  # See note in build-android.yml about Gitea PR-from-fork secret stripping.
-  push:
-    branches: [dev, main]
+  # Manual-only for now. Trigger via Actions → "Hash Bags iOS Simulator
+  # build" → Run workflow when you want a build.
   workflow_dispatch:
 
 # Cancel in-flight runs when a newer commit lands on the same branch — so a
diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index e8422c0ef..332824cd8 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -5,12 +5,9 @@ name: Hash Bags Linux build
 # - on PRs targeting dev/main (gates merges)
 # - manual via workflow_dispatch ("Run workflow" button in the UI)
 on:
-  # See note in build-android.yml about pull_request vs push triggers and
-  # Gitea Actions' from-fork secret stripping. Push-only here too for
-  # consistency (no secrets are required for Linux build today, but if we
-  # add any in future this avoids surprises).
-  push:
-    branches: [dev, main]
+  # Manual-only for now — auto-run on every push was too noisy. Trigger
+  # via Actions → "Hash Bags Linux build" → Run workflow when you want a
+  # build. Add `push:` back here if/when we want pre-merge validation.
   workflow_dispatch:
 
 concurrency: