diff --git a/.github/workflows/_build-image.yaml b/.github/workflows/_build-image.yaml
index dae72e318..f88552fbc 100644
--- a/.github/workflows/_build-image.yaml
+++ b/.github/workflows/_build-image.yaml
@@ -49,6 +49,7 @@ jobs:
   meta:
     name: resolve metadata
     runs-on: ubuntu-24.04
+    environment: builds
     timeout-minutes: 5
     outputs:
       build_version: ${{ steps.vars.outputs.build_version }}
@@ -73,6 +74,7 @@ jobs:
     name: build ${{ matrix.platform }}
     needs: meta
     runs-on: ${{ matrix.runner }}
+    environment: builds
     timeout-minutes: 75
     strategy:
       fail-fast: false
@@ -113,6 +115,7 @@ jobs:
     name: merge multi-arch manifest
     needs: [meta, build]
     runs-on: ubuntu-24.04
+    environment: builds
     timeout-minutes: 10
     steps:
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
diff --git a/.github/workflows/build-app-proxy.yaml b/.github/workflows/build-app-proxy.yaml
index 305fbfcdb..e49efb837 100644
--- a/.github/workflows/build-app-proxy.yaml
+++ b/.github/workflows/build-app-proxy.yaml
@@ -29,6 +29,7 @@ jobs:
   meta:
     name: resolve metadata
     runs-on: ubuntu-24.04
+    environment: builds
     timeout-minutes: 5
     outputs:
       build_version: ${{ steps.vars.outputs.build_version }}
@@ -51,6 +52,7 @@ jobs:
     name: build app-proxy (amd64)
     needs: meta
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    environment: builds
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
@@ -104,6 +106,7 @@ jobs:
     name: build app-proxy (arm64)
     needs: meta
     runs-on: blacksmith-4vcpu-ubuntu-2404-arm
+    environment: builds
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
@@ -136,6 +139,7 @@ jobs:
     name: merge multi-arch manifest
     needs: [meta, build, build-arm64]
     runs-on: ubuntu-24.04
+    environment: builds
     timeout-minutes: 10
     steps:
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
diff --git a/.github/workflows/build-desktop.yaml b/.github/workflows/build-desktop.yaml
index 897d4fc1a..d76d14668 100644
--- a/.github/workflows/build-desktop.yaml
+++ b/.github/workflows/build-desktop.yaml
@@ -45,6 +45,7 @@ jobs:
   meta:
     name: Resolve build metadata
     runs-on: ubuntu-24.04-arm
+    environment: desktop-releases
     timeout-minutes: 25
     outputs:
       version: ${{ steps.meta.outputs.version }}
@@ -79,6 +80,7 @@ jobs:
   matrix:
     name: Resolve build matrix
     runs-on: ubuntu-24.04-arm
+    environment: desktop-releases
     timeout-minutes: 25
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
@@ -110,6 +112,7 @@ jobs:
       - meta
       - matrix
     runs-on: ${{ matrix.os }}
+    environment: desktop-releases
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -421,6 +424,7 @@ jobs:
   check_signing:
     name: Check signing secrets
     runs-on: ubuntu-24.04-arm
+    environment: desktop-releases
     timeout-minutes: 5
     outputs:
       enabled: ${{ steps.check.outputs.enabled }}
@@ -450,6 +454,7 @@ jobs:
       - build
       - check_signing
     runs-on: blacksmith-32vcpu-windows-2025
+    environment: desktop-releases
     timeout-minutes: 25
     env:
       BUILD_CHANNEL: ${{ needs.meta.outputs.build_channel }}
@@ -562,6 +567,7 @@ jobs:
       - build
       - sign_windows
     runs-on: ubuntu-24.04-arm
+    environment: desktop-releases
     timeout-minutes: 60
     env:
       CHANNEL: ${{ needs.meta.outputs.build_channel }}
diff --git a/.github/workflows/repair-static-asset-metadata.yaml b/.github/workflows/repair-static-asset-metadata.yaml
index e6e38caab..8217832b0 100644
--- a/.github/workflows/repair-static-asset-metadata.yaml
+++ b/.github/workflows/repair-static-asset-metadata.yaml
@@ -13,6 +13,7 @@ on:
 jobs:
   repair:
     runs-on: ubuntu-24.04
+    environment: static-assets
     timeout-minutes: 30
     permissions:
       contents: read
diff --git a/.github/workflows/sync-static-bucket.yaml b/.github/workflows/sync-static-bucket.yaml
index 51fa6e16b..89f8a434c 100644
--- a/.github/workflows/sync-static-bucket.yaml
+++ b/.github/workflows/sync-static-bucket.yaml
@@ -7,6 +7,7 @@ on:
 jobs:
   push:
     runs-on: ubuntu-24.04
+    environment: static-assets
     timeout-minutes: 30
     permissions:
       contents: read