diff --git a/.gitea/workflows/build-linux.yml b/.gitea/workflows/build-linux.yml
index d3da5840..f59b1e8c 100644
--- a/.gitea/workflows/build-linux.yml
+++ b/.gitea/workflows/build-linux.yml
@@ -1,7 +1,7 @@
 name: linux appimage (gitea self-hosted)
 
 # Runs ONLY on Gitea (GitHub ignores .gitea/workflows), in the private Builds
-# repository. Gitea is master; GitHub is a mirror and a release surface.
+# repository. GitHub wownero/wowlet owns source and release publication.
 #
 # Unlike the Windows lane, which builds a static toolchain of its own through
 # contrib/depends, the x86_64 AppImage links against the host's Qt6. Those
diff --git a/.gitea/workflows/build-windows.yml b/.gitea/workflows/build-windows.yml
index a9df31db..655590e4 100644
--- a/.gitea/workflows/build-windows.yml
+++ b/.gitea/workflows/build-windows.yml
@@ -1,7 +1,7 @@
 name: windows build + sign (gitea self-hosted)
 
 # Runs ONLY on Gitea (GitHub ignores .gitea/workflows), in the private Builds
-# repository. Gitea is master; GitHub is a mirror and a release surface.
+# repository. GitHub wownero/wowlet owns source and release publication.
 #
 # Two jobs on two different machines, and that split is the whole point:
 #
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ae77d335..10404ac6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,6 +1,7 @@
 name: ci/gh-actions/build
 
-on: [push, pull_request, workflow_dispatch]
+# Legacy builds are manual only. Release artifacts are built in Builds/wowlet.
+on: [workflow_dispatch]
 
 # NOTE (wownero-rebase branch): the Arch + macOS jobs from upstream Feather's build.yml are
 # temporarily disabled to get a fast, cheap iteration loop while bringing up the build against the
diff --git a/.gitea/workflows/check.yml b/.github/workflows/check.yml
similarity index 82%
rename from .gitea/workflows/check.yml
rename to .github/workflows/check.yml
index 9242085a..04d6c379 100644
--- a/.gitea/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -2,10 +2,14 @@ name: source checks
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   docs:
     name: Wowlet documentation gate
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
       - name: Check generated documentation and support contacts
diff --git a/.github/workflows/guix.yml b/.github/workflows/guix.yml
index 2a709771..7fe95eb8 100644
--- a/.github/workflows/guix.yml
+++ b/.github/workflows/guix.yml
@@ -1,6 +1,7 @@
 name: ci/gh-actions/guix
 
-on: [push, pull_request]
+# Legacy builds are manual only. Release artifacts are built in Builds/wowlet.
+on: [workflow_dispatch]
 
 jobs:
   cache-sources:
diff --git a/README.md b/README.md
index 58a4cfd1..199cb4a2 100644
--- a/README.md
+++ b/README.md
@@ -6,8 +6,7 @@ Qt. It is based on [Feather Wallet](https://github.com/feather-wallet/feather).
 ## Download
 
 Download Wowlet and its signed release hashes from
-[Wowlet releases](https://github.com/wownero/wowlet/releases). The desktop wallet
-link on [wownero.org](https://wownero.org/) also leads there.
+[Wowlet releases](https://github.com/wownero/wowlet/releases).
 
 ## Support
 
@@ -25,6 +24,11 @@ Report vulnerabilities privately using [SECURITY.md](SECURITY.md).
 
 ## Development
 
+[GitHub](https://github.com/wownero/wowlet) is the canonical source repository.
+Release builds run in our private Builds system. Signed release artifacts and
+hashes are published on GitHub Releases. GitHub runs lightweight source checks;
+its legacy build workflows require an explicit manual dispatch.
+
 The application includes an offline documentation browser under Help. Its guides
 are generated by `contrib/docs/generate.py` from the Feather documentation submodule.
 Wowlet-specific guides in `contrib/docs/overrides` take precedence over upstream