diff --git a/.gitea/workflows/android.yml b/.gitea/workflows/android.yml
index 2586114..5707485 100644
--- a/.gitea/workflows/android.yml
+++ b/.gitea/workflows/android.yml
@@ -68,6 +68,21 @@ jobs:
         run: |
           printf '%s' "$KEYSTORE" | base64 -d > /tmp/upload.keystore
           trap 'rm -f /tmp/upload.keystore' EXIT
+          # Check the signing secrets up front (without printing them) rather than 15 minutes in.
+          missing=
+          [ -n "$KEYSTORE" ] || missing="$missing UPLOAD_KEYSTORE_BASE64"
+          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD" ] || missing="$missing UPLOAD_STORE_PASSWORD"
+          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS" ] || missing="$missing UPLOAD_KEY_ALIAS"
+          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_PASSWORD" ] || missing="$missing UPLOAD_KEY_PASSWORD"
+          if [ -n "$missing" ]; then
+            echo "These secrets are empty or missing (repo Settings > Actions > Secrets, not Variables):$missing" >&2
+            exit 1
+          fi
+          if ! keytool -list -keystore /tmp/upload.keystore -storepass "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD" \
+              -alias "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS" >/dev/null; then
+            echo "The keystore didn't open: check UPLOAD_KEYSTORE_BASE64, UPLOAD_STORE_PASSWORD and UPLOAD_KEY_ALIAS." >&2
+            exit 1
+          fi
           apps/mobile/scripts/build-android.sh "$PWD/out"
 
       - name: Publish