diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index b49d23f..a53e4dd 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -211,10 +211,12 @@ jobs:
           THUMB:         ${{ secrets.CODESIGN_THUMBPRINT }}
           PFX_B64:       ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
           PFX_PWD:       ${{ secrets.CODESIGN_CERT_PASSWORD }}
-          MAGE:          ${{ env.MAGE }}
-          SIGNTOOL:      ${{ env.SIGNTOOL }}
           VERSION:       ${{ steps.ver.outputs.version }}
           VERSION_USCORE: ${{ steps.ver.outputs.versionUscore }}
+          # NOTE: MAGE and SIGNTOOL come from $GITHUB_ENV set by the "Resolve"
+          # step earlier; do NOT redeclare them here -- a passthrough like
+          # `MAGE: ${{ env.MAGE }}` evaluates at parse time and overwrites
+          # the runtime value with empty.
         run: |
           $ErrorActionPreference = 'Continue'
           Start-Transcript -Path publish.console.log -IncludeInvocationHeader -Force