diff --git a/.github/workflows/build-app.yaml b/.github/workflows/build-app.yaml
index 079b73865..7fee1a95b 100644
--- a/.github/workflows/build-app.yaml
+++ b/.github/workflows/build-app.yaml
@@ -58,15 +58,12 @@ jobs:
           SIGNING_PASSWORD: '${{ secrets.SIGNING_PASSWORD }}'
           SYNCTHING_RELEASE_STORE_FILE: '${{ runner.temp }}/signing-keystore.jks'
           SYNCTHING_RELEASE_PLAY_ACCOUNT_CONFIG_FILE: '${{ runner.temp }}/google-play-secrets.json'
-        shell: bash             # main purpose: enables -eo pipefail
+        shell: bash
         run: |
           set -eu -o pipefail
-          echo "$SIGNING_KEYSTORE_JKS_BASE64"
-          echo "$GOOGLE_PLAY_SECRETS_BASE64"
-          echo "$SIGNING_KEYSTORE_JKS_BASE64" | base64 -d > "$SYNCTHING_RELEASE_STORE_FILE"
-          echo "$GOOGLE_PLAY_SECRETS_BASE64" | base64 -d > "$SYNCTHING_RELEASE_PLAY_ACCOUNT_CONFIG_FILE"
+          echo '${{ secrets.SIGNING_KEYSTORE_JKS_BASE64 }}' | base64 -d > "$SYNCTHING_RELEASE_STORE_FILE"
+          echo '${{ GOOGLE_PLAY_SECRETS_BASE64 }}' | base64 -d > "$SYNCTHING_RELEASE_PLAY_ACCOUNT_CONFIG_FILE"
           java -version
-          cat "$SYNCTHING_RELEASE_STORE_FILE"
           ./gradlew --no-daemon buildNative lint assembleRelease
           rm "$SYNCTHING_RELEASE_STORE_FILE" "$SYNCTHING_RELEASE_PLAY_ACCOUNT_CONFIG_FILE"