diff --git a/.gitea/workflows/pixel10.yml b/.gitea/workflows/pixel10.yml
index fab5cf84..b2acbc3e 100644
--- a/.gitea/workflows/pixel10.yml
+++ b/.gitea/workflows/pixel10.yml
@@ -17,6 +17,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Validate signing configuration
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "$KEY_JKS"
+          test -n "$KEY_PASSWORD"
+          test -n "$KEY_ALIAS"
+          printf '%s' "$KEY_JKS" | base64 -d > "$KEY_PATH"
+          chmod 600 "$KEY_PATH"
+
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
@@ -78,14 +88,6 @@ jobs:
           IPTPROXY_SOURCE: ${{ runner.temp }}/IPtProxy
         run: melos run build-go-runtime --no-select
 
-      - name: Create release key
-        shell: bash
-        run: |
-          set -euo pipefail
-          test -n "$KEY_JKS"
-          printf '%s' "$KEY_JKS" | base64 -d > "$KEY_PATH"
-          chmod 600 "$KEY_PATH"
-
       - name: Build and verify Pixel 10 APK
         run: melos run build-browser-pixel10 --no-select
 
diff --git a/PIXEL_10.md b/PIXEL_10.md
index 266460c7..bde3e945 100644
--- a/PIXEL_10.md
+++ b/PIXEL_10.md
@@ -41,6 +41,33 @@ apps/weblibre/build/app/outputs/flutter-apk/app-pixel10-release.apk
 Release builds require the same signing environment variables as upstream:
 `KEY_PATH`, `KEY_ALIAS`, and `KEY_PASSWORD`.
 
+## Gitea Actions
+
+The workflow at `.gitea/workflows/pixel10.yml` runs on every push to the
+`pixel10` branch and can also be started manually. It needs an Actions runner
+with the `ubuntu-latest` label and these repository secrets:
+
+| Secret | Value |
+| --- | --- |
+| `PIXEL10_KEY_JKS` | Base64-encoded Android signing keystore |
+| `PIXEL10_KEY_ALIAS` | Alias of the signing key |
+| `PIXEL10_KEY_PASSWORD` | Keystore and key password |
+
+Create a dedicated key once and keep both the keystore and password backed up.
+Losing the signing key makes it impossible to install future updates over an
+existing MrbWebLibre installation.
+
+```bash
+keytool -genkeypair -v \
+  -keystore pixel10-release.jks \
+  -alias mrbweblibre \
+  -keyalg RSA -keysize 4096 -validity 10000
+base64 -w 0 pixel10-release.jks
+```
+
+Add the resulting one-line Base64 value as `PIXEL10_KEY_JKS`; do not commit the
+keystore itself. The workflow removes the decoded file even when a build fails.
+
 ## Verify an existing APK
 
 ```bash