diff --git a/.forgejo/workflows/build-apk.yml b/.forgejo/workflows/build-apk.yml
index 506f1c9..34cdd7d 100644
--- a/.forgejo/workflows/build-apk.yml
+++ b/.forgejo/workflows/build-apk.yml
@@ -38,7 +38,7 @@ jobs:
           sdkmanager "ndk;27.1.12297006" >/dev/null 2>&1 || true
 
       - name: Restore signing keystore
-        run: echo "${{ secrets.ANDROID_KEYSTORE_B64 }}" | base64 -d > "$GITHUB_WORKSPACE/app/release.keystore"
+        run: echo "${{ secrets.ANDROID_KEYSTORE_B64 }}" | base64 -d > "${{ github.workspace }}/app/release.keystore"
 
       - name: Expo prebuild (generate android/)
         working-directory: app
diff --git a/app/plugins/withReleaseSigning.js b/app/plugins/withReleaseSigning.js
index fc629fe..2c2e7d4 100644
--- a/app/plugins/withReleaseSigning.js
+++ b/app/plugins/withReleaseSigning.js
@@ -34,10 +34,11 @@ module.exports = function withReleaseSigning(config) {
         `signingConfigs {${SIGNING_BLOCK}`,
       );
       // 2) Point the release buildType at the release key when its env is set, else
-      //    debug. Replace the RN template's unconditional debug line inside the
-      //    release {} block (otherwise it overrides the release config).
+      //    debug. Anchor on `buildTypes { … release {` so we hit the release
+      //    BUILD TYPE's debug line — not the `release {}` we just added inside
+      //    signingConfigs {} (which would leave release builds on the debug key).
       gradle = gradle.replace(
-        /(release \{[\s\S]*?)signingConfig signingConfigs\.debug/,
+        /(buildTypes \{[\s\S]*?release \{[\s\S]*?)signingConfig signingConfigs\.debug/,
         `$1signingConfig System.getenv("BBP_UPLOAD_STORE_FILE") != null ? signingConfigs.release : signingConfigs.debug`,
       );
     }