diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e543371..e2d78ea 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,12 +31,14 @@ jobs:
             "cmake;3.22.1" \
             --sdk_root=$ANDROID_SDK_ROOT
 
+      - name: Decode keystore
+        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > $RUNNER_TEMP/keystore.jks
+
       - name: Build signed release AAB
         env:
-          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+          KEYSTORE_PATH: ${{ runner.temp }}/keystore.jks
           KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
           KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
-          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: ./gradlew bundleRelease
 
       - name: Rename AAB with version
diff --git a/app/build.gradle b/app/build.gradle
index 3478fe4..952f525 100644
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -23,12 +23,9 @@ android {
 
     signingConfigs {
         release {
-            def b64 = System.getenv("KEYSTORE_BASE64")
-            if (b64) {
-                def ks = file("${buildDir}/keystore.jks")
-                ks.parentFile.mkdirs()
-                ks.bytes = b64.decodeBase64()
-                storeFile = ks
+            def ksPath = System.getenv("KEYSTORE_PATH")
+            if (ksPath) {
+                storeFile = file(ksPath)
             }
             storePassword = System.getenv("KEYSTORE_PASSWORD") ?: ""
             keyAlias = System.getenv("KEY_ALIAS") ?: "dedx-upload"
@@ -57,7 +54,7 @@ android {
         release {
             minifyEnabled = false
             proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
-            if (System.getenv("KEYSTORE_BASE64")) {
+            if (System.getenv("KEYSTORE_PATH")) {
                 signingConfig = signingConfigs.release
             }
         }