diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7039255..88e9feb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -86,11 +86,19 @@ jobs:
       # keeps the secret out of the filesystem entirely, and keeps the signing configuration in one
       # place instead of a second, divergent one in this workflow.
       - name: Restore the signing key
-        if: ${{ secrets.RELEASE_KEYSTORE_BASE64 != '' }}
+        # No `if:` here on purpose. Conditioning a step on `secrets` is something the workflow
+        # parser is unhappy about, and the condition is not needed: a missing secret is a failure,
+        # not a reason to publish a differently-signed build. The check lives inside the script,
+        # where it is a plain shell test.
         env:
           KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }}
           STORE_PASSWORD: ${{ secrets.RELEASE_KEYSTORE_PASSWORD }}
         run: |
+          if [ -z "$KEYSTORE_BASE64" ]; then
+            echo "::error::RELEASE_KEYSTORE_BASE64 is not set, so the release would be signed with the debug key."
+            echo "::error::Add the keystore as a repository secret and re-run the release."
+            exit 1
+          fi
           echo "$KEYSTORE_BASE64" | base64 -d > release-key.p12
           # Written to $GITHUB_ENV, not echoed: the value goes into the file, not the log.
           echo "STORE_FILE=$GITHUB_WORKSPACE/release-key.p12" >> "$GITHUB_ENV"
@@ -99,15 +107,6 @@ jobs:
           echo "KEY_PASSWORD=$STORE_PASSWORD" >> "$GITHUB_ENV"
           echo "the signing key has been restored"
 
-      - name: Refuse to publish without a signing key
-        # A release signed with the wrong key is worse than no release: it installs once and then
-        # refuses to update, and the user has to uninstall and lose their settings. Failing here
-        # is the point.
-        if: ${{ secrets.RELEASE_KEYSTORE_BASE64 == '' }}
-        run: |
-          echo "::error::RELEASE_KEYSTORE_BASE64 is not set, so the release would be signed with the debug key."
-          echo "::error::Add the keystore as a repository secret and re-run the release."
-          exit 1
 
       - name: Build release APK
         run: ./gradlew assembleRelease --stacktrace
@@ -115,7 +114,6 @@ jobs:
       - name: Verify the signature
         # A release that is not signed with the release key is worse than no release: it installs
         # once and then refuses to update. Checked here, before anything is published.
-        if: ${{ secrets.RELEASE_KEYSTORE_BASE64 != '' }}
         run: |
           APKSIGNER=$(ls "$ANDROID_HOME"/build-tools/*/apksigner | tail -1)
           "$APKSIGNER" verify --print-certs app/build/outputs/apk/release/*.apk