diff --git a/.gitea/workflows/windows-release.yml b/.github/workflows/mirror-tags-to-github.yml
similarity index 80%
rename from .gitea/workflows/windows-release.yml
rename to .github/workflows/mirror-tags-to-github.yml
index 3c3dd957..8adf397e 100644
--- a/.gitea/workflows/windows-release.yml
+++ b/.github/workflows/mirror-tags-to-github.yml
@@ -3,14 +3,21 @@ name: Mirror release tags to GitHub build bridge
 # Gitea is the source of truth for releases, but this instance has no Windows
 # runner (only ubuntu-latest on the homeserver), and Flutter Windows builds
 # require a Windows host. So when a tag is pushed here, this workflow mirrors it
-# to the public GitHub fork yorickr/plezy, whose only active workflow
-# (.github/workflows/windows-gitea-release.yml) builds the Windows release on
-# GitHub-hosted runners and publishes the artifacts back to this repo's Gitea
-# release for the same tag.
+# to the public GitHub fork yorickr/plezy, whose windows-gitea-release workflow
+# builds the Windows release on GitHub-hosted runners and publishes the
+# artifacts back to this repo's Gitea release for the same tag.
+#
+# This file lives in .github/workflows (not .gitea/workflows) on purpose:
+# Gitea's workflow discovery uses the first existing directory in
+# [".gitea/workflows", ".github/workflows"], so a .gitea/workflows directory
+# would shadow every other workflow in this repo (ci.yml et al.) on Gitea.
 #
 # The write path uses an SSH deploy key (secret RELEASE_PUSH_KEY) that only has
 # access to the fork. ssh.github.com:443 is used because the homeserver
 # demonstrably reaches GitHub over 443, and it avoids depending on outbound 22.
+#
+# The job-level guard keeps this from running on GitHub (the fork would
+# otherwise attempt it on every mirrored tag and fail on the missing secret).
 
 on:
   push:
@@ -26,6 +33,7 @@ on:
 jobs:
   mirror-tag:
     name: Mirror tag to GitHub
+    if: github.server_url != 'https://github.com'
     runs-on: ubuntu-latest
     permissions:
       contents: read