diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5ce6b717..16000ecb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -152,11 +152,13 @@ jobs:
           TARBALL="$APPIMAGE.tar.gz"
           rm -f "$TARBALL" "$APPIMAGE.sig" "$TARBALL.sig"
           tar czf "$TARBALL" -C "$(dirname "$APPIMAGE")" "$(basename "$APPIMAGE")"
-          KEY_PATH=$(mktemp)
-          printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
-          trap 'rm -f "$KEY_PATH"' EXIT
-          npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
-          npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
+          # Sign straight from the environment. TAURI_SIGNING_PRIVATE_KEY is
+          # the env form of --private-key, so ALSO passing -f/--private-key-path
+          # makes the CLI abort: "the argument '--private-key-path' cannot be
+          # used with '--private-key'". Keeping the key in the env instead of a
+          # temp file also keeps it off the runner's disk.
+          npx tauri signer sign -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
+          npx tauri signer sign -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
 
       - name: Stage Linux release assets
         shell: bash
@@ -303,11 +305,13 @@ jobs:
           TARBALL="$APPIMAGE.tar.gz"
           rm -f "$TARBALL" "$APPIMAGE.sig" "$TARBALL.sig"
           tar czf "$TARBALL" -C "$(dirname "$APPIMAGE")" "$(basename "$APPIMAGE")"
-          KEY_PATH=$(mktemp)
-          printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
-          trap 'rm -f "$KEY_PATH"' EXIT
-          npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
-          npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
+          # Sign straight from the environment. TAURI_SIGNING_PRIVATE_KEY is
+          # the env form of --private-key, so ALSO passing -f/--private-key-path
+          # makes the CLI abort: "the argument '--private-key-path' cannot be
+          # used with '--private-key'". Keeping the key in the env instead of a
+          # temp file also keeps it off the runner's disk.
+          npx tauri signer sign -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
+          npx tauri signer sign -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
 
       - name: Stage Linux ARM64 release assets
         shell: bash