diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..6d3c3dd
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,36 @@
+# Weekly update PRs for every ecosystem the repo ships. Minor and patch bumps
+# are grouped into one PR per ecosystem to keep the noise down; majors still
+# arrive one PR each so a breaking change can be reviewed on its own.
+
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /web
+    schedule:
+      interval: weekly
+    groups:
+      npm-minor-patch:
+        update-types: [minor, patch]
+
+  # Reads android/gradle/libs.versions.toml (the version catalog) as well as
+  # the build scripts.
+  - package-ecosystem: gradle
+    directory: /android
+    schedule:
+      interval: weekly
+    groups:
+      gradle-minor-patch:
+        update-types: [minor, patch]
+
+  # "/" covers .github/workflows; the composite actions are separate
+  # manifests and must be listed explicitly.
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: weekly
+    groups:
+      actions-minor-patch:
+        update-types: [minor, patch]
diff --git a/.github/workflows/android-release.yml b/.github/workflows/android-release.yml
index d33bb78..f54f145 100644
--- a/.github/workflows/android-release.yml
+++ b/.github/workflows/android-release.yml
@@ -62,10 +62,30 @@ jobs:
         run: ./gradlew :app:lint :app:test
         working-directory: android
 
+      # An unset secret expands to an empty string, which would otherwise
+      # decode to a zero-byte keystore and fail later inside Gradle with an
+      # unrelated-looking error. Check every signing secret up front.
       - name: Decode keystore
         env:
           KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
-        run: printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$GITHUB_WORKSPACE/keystore.p12"
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: |
+          set -eu
+          missing=0
+          for name in KEYSTORE_BASE64 KEYSTORE_PASSWORD KEY_ALIAS KEY_PASSWORD; do
+            if [ -z "$(printenv "$name")" ]; then
+              echo "::error::Repository secret $name is empty or not set; it is required to sign the release."
+              missing=1
+            fi
+          done
+          [ "$missing" -eq 0 ] || exit 1
+          printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$GITHUB_WORKSPACE/keystore.p12"
+          if [ ! -s "$GITHUB_WORKSPACE/keystore.p12" ]; then
+            echo "::error::KEYSTORE_BASE64 decoded to an empty keystore; re-encode it with 'base64 -w0 keystore.p12'."
+            exit 1
+          fi
 
       - name: Build signed AAB + APK
         working-directory: android
@@ -76,7 +96,7 @@ jobs:
           LOTO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: ./gradlew :app:bundleRelease :app:assembleRelease
 
-      # L10: the decoded keystore has no real exposure on this ephemeral
+      # The decoded keystore has no real exposure on this ephemeral
       # runner (nothing archives the workspace), but removing it explicitly
       # closes the class of mistake where a future step does. if: always()
       # so it runs even if the build step above fails.