diff --git a/.github/workflows/build_push.yml b/.github/workflows/build_push.yml
index 078b3e4d4b5..852ce12f1db 100644
--- a/.github/workflows/build_push.yml
+++ b/.github/workflows/build_push.yml
@@ -21,6 +21,7 @@ concurrency:
 env:
   CI_CHUNK_SIZE: 80
   IS_PR_CHECK: false
+  KEI_CI: true
 
 jobs:
   prepare:
@@ -72,16 +73,13 @@ jobs:
         with:
           cache-read-only: ${{ matrix.chunk.number > 1 }}
 
-      - name: Prepare signing key
-        run: |
-          echo ${{ secrets.SIGNING_KEY }} | base64 -d > signingkey.jks
-
       - name: Build extensions (${{ matrix.chunk.number }})
         env:
           MODULES: ${{ join(matrix.chunk.modules, ' ') }}
-          ALIAS: ${{ secrets.ALIAS }}
-          KEY_STORE_PASSWORD: ${{ secrets.KEY_STORE_PASSWORD }}
-          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+          storeFileBase64: ${{ secrets.SIGNING_KEY }}
+          storePassword: ${{ secrets.KEY_STORE_PASSWORD }}
+          keyAlias: ${{ secrets.ALIAS }}
+          keyPassword: ${{ secrets.KEY_PASSWORD }}
         run: |
           ./gradlew $MODULES
 
@@ -96,10 +94,6 @@ jobs:
             **/build/keiyoushi-source-info.json
           retention-days: 1
 
-      - name: Clean up CI files
-        if: always()
-        run: rm signingkey.jks
-
   publish:
     name: Publish extension repo
     needs: [prepare, build]
diff --git a/gradle/build-logic/src/main/kotlin/ExtensionPlugin.kt b/gradle/build-logic/src/main/kotlin/ExtensionPlugin.kt
index 61245932c3c..74a84c398ad 100644
--- a/gradle/build-logic/src/main/kotlin/ExtensionPlugin.kt
+++ b/gradle/build-logic/src/main/kotlin/ExtensionPlugin.kt
@@ -37,6 +37,7 @@ import org.gradle.kotlin.dsl.dependencies
 import org.gradle.kotlin.dsl.findByType
 import org.gradle.kotlin.dsl.register
 import org.gradle.kotlin.dsl.withType
+import kotlin.io.encoding.Base64
 
 @Suppress("UNUSED")
 class ExtensionPlugin : Plugin<Project> {
@@ -78,22 +79,25 @@ class ExtensionPlugin : Plugin<Project> {
                 checkReleaseBuilds = false
             }
 
-            signingConfigs {
-                create("release") {
-                    storeFile = rootProject.file("signingkey.jks")
-                    storePassword = providers.environmentVariable("KEY_STORE_PASSWORD").orNull
-                    keyAlias = providers.environmentVariable("ALIAS").orNull
-                    keyPassword = providers.environmentVariable("KEY_PASSWORD").orNull
+            if (System.getenv("KEI_CI").toBoolean()) {
+                val tempStoreFile = file(System.getenv("RUNNER_TEMP")).resolve("signingkey.jks")
+
+                val storeFileBytes = System.getenv("storeFileBase64").let(Base64::decode)
+                tempStoreFile.outputStream().use { it.write(storeFileBytes) }
+
+                signingConfigs {
+                    named("debug") {
+                        storeFile = tempStoreFile
+                        storePassword = System.getenv("storePassword")
+                        keyAlias = System.getenv("keyAlias")
+                        keyPassword = System.getenv("keyPassword")
+                    }
                 }
             }
 
             buildTypes {
                 named("release") {
-                    signingConfig = if (rootProject.file("signingkey.jks").exists()) {
-                        signingConfigs.getByName("release")
-                    } else {
-                        signingConfigs.getByName("debug")
-                    }
+                    signingConfig = getByName("debug").signingConfig
                     isMinifyEnabled = true
                     proguardFiles(rootProject.file("common/proguard-rules.pro"))
                     @Suppress("UnstableApiUsage")