diff --git a/.github/workflows/nightly-ci.yml b/.github/workflows/nightly-ci.yml
index a9edfe95cb..91deaf8a44 100644
--- a/.github/workflows/nightly-ci.yml
+++ b/.github/workflows/nightly-ci.yml
@@ -14,11 +14,6 @@ jobs:
   build:
     if: ${{ github.repository == 'osfans/trime' && github.ref == 'refs/heads/develop' }}
     runs-on: ubuntu-24.04
-    env:
-      SIGN_KEY_BASE64: ${{ secrets.SIGNING_KEY }}
-      SIGN_KEY_STORE_PWD: ${{ secrets.KEY_STORE_PASSWORD }}
-      SIGN_KEY_ALIAS: ${{ secrets.ALIAS }}
-      SIGN_KEY_PWD: ${{ secrets.KEY_PASSWORD }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -49,6 +44,15 @@ jobs:
       - name: Setup Android SDK
         uses: android-actions/setup-android@v3
 
+      - name: Setup Keystore
+        run: |
+          cat << EOF > keystore.properties
+          keyBase64=${{ secrets.SIGNING_KEY }}
+          storePassword=${{ secrets.KEY_STORE_PASSWORD }}
+          keyAlias=${{ secrets.ALIAS }}
+          keyPassword=${{ secrets.KEY_PASSWORD }}
+          EOF
+
       - name: Build Trime
         run: make release
 
diff --git a/.github/workflows/release-ci.yml b/.github/workflows/release-ci.yml
index 656304c73d..1364ed2dc8 100644
--- a/.github/workflows/release-ci.yml
+++ b/.github/workflows/release-ci.yml
@@ -13,11 +13,6 @@ env:
 jobs:
   build:
     runs-on: ubuntu-24.04
-    env:
-      SIGN_KEY_BASE64: ${{ secrets.SIGNING_KEY }}
-      SIGN_KEY_STORE_PWD: ${{ secrets.KEY_STORE_PASSWORD }}
-      SIGN_KEY_ALIAS: ${{ secrets.ALIAS }}
-      SIGN_KEY_PWD: ${{ secrets.KEY_PASSWORD }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -48,6 +43,15 @@ jobs:
       - name: Setup Android SDK
         uses: android-actions/setup-android@v3
 
+      - name: Setup Keystore
+        run: |
+          cat << EOF > keystore.properties
+          keyBase64=${{ secrets.SIGNING_KEY }}
+          storePassword=${{ secrets.KEY_STORE_PASSWORD }}
+          keyAlias=${{ secrets.ALIAS }}
+          keyPassword=${{ secrets.KEY_PASSWORD }}
+          EOF
+
       - name: Build Trime
         run: make release
 
diff --git a/build-logic/convention/src/main/kotlin/ProjectExtensions.kt b/build-logic/convention/src/main/kotlin/ProjectExtensions.kt
index e1204202c6..6f6ecc21d2 100644
--- a/build-logic/convention/src/main/kotlin/ProjectExtensions.kt
+++ b/build-logic/convention/src/main/kotlin/ProjectExtensions.kt
@@ -7,6 +7,7 @@ import org.gradle.api.Project
 import org.gradle.api.Task
 import java.io.ByteArrayOutputStream
 import java.io.File
+import java.util.Properties
 import kotlin.io.encoding.Base64
 import kotlin.io.encoding.ExperimentalEncodingApi
 
@@ -80,20 +81,29 @@ val Project.buildTimestamp
             System.currentTimeMillis().toString()
         }
 
+val Project.signKeyStoreProps: Properties?
+    get() {
+        val name =
+            envOrPropOrNull("KEYSTORE_PROPERTIES", "keystoreProperties")
+                ?: "keystore.properties"
+        val file = File(name)
+        return if (file.exists()) Properties().apply { load(file.inputStream()) } else null
+    }
+
 val Project.signKeyBase64: String?
-    get() = envOrPropOrNull("SIGN_KEY_BASE64", "signKeyBase64")
+    get() = signKeyStoreProps?.get("keyBase64") as? String
 
 val Project.signKeyStore
-    get() = envOrPropOrNull("SIGN_KEY_STORE", "signKeyStore")
+    get() = signKeyStoreProps?.get("storeFile") as? String
 
 val Project.signKeyStorePwd
-    get() = envOrPropOrNull("SIGN_KEY_STORE_PWD", "signKeyStorePwd")
+    get() = signKeyStoreProps?.get("storePassword") as? String
 
 val Project.signKeyAlias
-    get() = envOrPropOrNull("SIGN_KEY_ALIAS", "signKeyAlias")
+    get() = signKeyStoreProps?.get("keyAlias") as? String
 
 val Project.signKeyPwd
-    get() = envOrPropOrNull("SIGN_KEY_PWD", "signKeyPwd")
+    get() = signKeyStoreProps?.get("keyPassword") as? String
 
 val Project.signKeyFile: File?
     get() {