diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3e84257..d3320f81 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -239,10 +239,13 @@ jobs:
             tauri-cli-${{ runner.os }}-
 
       - run: pnpm install --frozen-lockfile
-      - run: pnpm build
+      # PR build verification only: disable updater-artifact signing so the build
+      # needs no secrets. Fork PRs don't receive repository secrets, so requiring
+      # TAURI_SIGNING_PRIVATE_KEY here makes every fork PR fail. Real signed
+      # updater artifacts are produced by the release flow (build-tauri.yml /
+      # nightly.yml) on trusted refs, which is the only place the key belongs.
+      - run: pnpm --filter @mcpmux/desktop exec tauri build --config '{"bundle":{"createUpdaterArtifacts":false}}'
         env:
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
           # Ad-hoc signing (no Apple Developer ID)
           APPLE_SIGNING_IDENTITY: '-'
 
diff --git a/.github/workflows/e2e-desktop.yml b/.github/workflows/e2e-desktop.yml
index ef677233..78ba9706 100644
--- a/.github/workflows/e2e-desktop.yml
+++ b/.github/workflows/e2e-desktop.yml
@@ -97,20 +97,23 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
+      # E2E only needs a runnable app binary, not signed updater artifacts.
+      # Drop the `updater` bundle and disable updater-artifact creation so the
+      # build requires no signing key — fork PRs don't receive repository
+      # secrets, so requiring the key here makes every fork PR fail. Signed
+      # updater artifacts are produced by the release flow on trusted refs.
       - name: Build app (Linux)
         if: matrix.os == 'ubuntu-latest'
-        run: pnpm --filter @mcpmux/desktop exec tauri build --bundles deb,rpm,updater
+        run: pnpm --filter @mcpmux/desktop exec tauri build --bundles deb,rpm --config '{"bundle":{"createUpdaterArtifacts":false}}'
         env:
           PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
 
       - name: Build app (Windows)
         if: matrix.os == 'windows-latest'
-        run: pnpm build
-        env:
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        # shell: bash so the inline --config JSON is passed verbatim; PowerShell's
+        # native-argument handling would mangle the embedded double quotes.
+        shell: bash
+        run: pnpm --filter @mcpmux/desktop exec tauri build --config '{"bundle":{"createUpdaterArtifacts":false}}'
 
       # TODO(playwright-migration): desktop E2E has stale assertions from the IA
       # redesign and is being replaced (tauri-playwright spike). Non-blocking