diff --git a/.github/workflows/windows-gitea-release.yml b/.github/workflows/windows-gitea-release.yml
index 480196e3..1178d409 100644
--- a/.github/workflows/windows-gitea-release.yml
+++ b/.github/workflows/windows-gitea-release.yml
@@ -73,7 +73,8 @@ jobs:
       - name: Upload symbols to bugs.plezy.app
         # Only when this fork has been given the admin token (the production
         # token lives on edde746/plezy, which is not the build bridge).
-        if: secrets.BUGS_ADMIN_TOKEN != ''
+        # The secrets context is unavailable in `if`, so gate on the env copy.
+        if: env.BUGS_ADMIN_TOKEN != ''
         shell: pwsh
         env:
           BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
@@ -92,7 +93,7 @@ jobs:
         run: .\windows\build-installer.ps1 -X64BuildDir "build\windows\x64\runner\Release" -Version "${{ steps.version.outputs.version }}"
 
       - name: Sign installer for WinSparkle (EdDSA)
-        if: secrets.SPARKLE_PRIVATE_KEY != ''
+        if: env.SPARKLE_PRIVATE_KEY != ''
         env:
           SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
         shell: pwsh