diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index d196aff..dfdc558 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -162,26 +162,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Add Office-capable MSBuild to PATH
-        shell: powershell
-        run: |
-          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
-          $installPath = & $vswhere -products * -requires Microsoft.VisualStudio.Workload.Office -property installationPath | Select-Object -First 1
-          if (-not $installPath) { throw "No VS installation with the Office workload found on this runner." }
-          Add-Content -Path $env:GITHUB_PATH -Value (Join-Path $installPath 'MSBuild\Current\Bin')
-
       - name: Publish ClickOnce (single step with transcript)
         shell: powershell
         env:
-          THUMB:         ${{ secrets.CODESIGN_THUMBPRINT }}
-          PFX_B64:       ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
-          PFX_PWD:       ${{ secrets.CODESIGN_CERT_PASSWORD }}
-          VERSION:       ${{ steps.ver.outputs.version }}
-          VERSION_USCORE: ${{ steps.ver.outputs.versionUscore }}
-          # NOTE: MAGE and SIGNTOOL come from $GITHUB_ENV set by the "Resolve"
-          # step earlier; do NOT redeclare them here -- a passthrough like
-          # `MAGE: ${{ env.MAGE }}` evaluates at parse time and overwrites
-          # the runtime value with empty.
+          THUMB:   ${{ secrets.CODESIGN_THUMBPRINT }}
+          PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }}
+          PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }}
         run: |
           $ErrorActionPreference = 'Continue'
           Start-Transcript -Path publish.console.log -IncludeInvocationHeader -Force
@@ -189,6 +175,14 @@ jobs:
           try {
               $thumb = $env:THUMB
 
+              Write-Host "=== STEP 0a: locate Office-capable MSBuild ==="
+              $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+              $vsInstall = & $vswhere -products * -requires Microsoft.VisualStudio.Workload.Office -property installationPath | Select-Object -First 1
+              if (-not $vsInstall) { throw "No VS installation with the Office workload found." }
+              $msbuildBin = Join-Path $vsInstall 'MSBuild\Current\Bin'
+              $env:PATH = "$msbuildBin;$env:PATH"
+              Write-Host "  MSBuild: $msbuildBin"
+
               Write-Host "=== STEP 0: resolve mage.exe + signtool.exe ==="
               $mage = Get-ChildItem 'C:\Program Files (x86)\Microsoft SDKs\Windows' -Recurse -Filter mage.exe -ErrorAction SilentlyContinue |
                   Sort-Object FullName -Descending | Select-Object -First 1