diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 2f1fdc9..ababfeb 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -11,10 +11,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "17"
+      # No actions/setup-java here on purpose: it exports JAVA_HOME, and Gradle
+      # prefers JAVA_HOME over PATH, so it would shadow devbox's openjdk17 with
+      # a JDK that Gradle 8.14.3 rejects. devbox provides the JDK.
 
       - name: Extract version
         run: |
@@ -33,11 +32,11 @@ jobs:
           KEY_ALIAS:      ${{ secrets.KEY_ALIAS }}
           KEY_PASSWORD:   ${{ secrets.KEY_PASSWORD }}
         run: |
-          DEVBOX="/mnt/data/Projects/code/kirakira/.devbox/nix/profile/default"
-          export PATH="${DEVBOX}/bin:$PATH"
-          export ANDROID_HOME="${DEVBOX}/share/android-sdk"
-          export ANDROID_SDK_ROOT="${DEVBOX}/share/android-sdk"
-          flutter build apk --release --flavor prod
+          # GITHUB_TOKEN is unset for devbox: it forwards it to nix as
+          # `--option access-tokens github.com=...`, but Forgejo's token is not
+          # a GitHub one, so fetching the flake-utils input 401s. Anonymous works.
+          env -u GITHUB_TOKEN -u GH_TOKEN -u JAVA_HOME \
+            devbox run -- flutter build apk --release --flavor prod
 
       - name: Create Forgejo Release and upload APK
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2f1fdc9..ababfeb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,10 +11,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "17"
+      # No actions/setup-java here on purpose: it exports JAVA_HOME, and Gradle
+      # prefers JAVA_HOME over PATH, so it would shadow devbox's openjdk17 with
+      # a JDK that Gradle 8.14.3 rejects. devbox provides the JDK.
 
       - name: Extract version
         run: |
@@ -33,11 +32,11 @@ jobs:
           KEY_ALIAS:      ${{ secrets.KEY_ALIAS }}
           KEY_PASSWORD:   ${{ secrets.KEY_PASSWORD }}
         run: |
-          DEVBOX="/mnt/data/Projects/code/kirakira/.devbox/nix/profile/default"
-          export PATH="${DEVBOX}/bin:$PATH"
-          export ANDROID_HOME="${DEVBOX}/share/android-sdk"
-          export ANDROID_SDK_ROOT="${DEVBOX}/share/android-sdk"
-          flutter build apk --release --flavor prod
+          # GITHUB_TOKEN is unset for devbox: it forwards it to nix as
+          # `--option access-tokens github.com=...`, but Forgejo's token is not
+          # a GitHub one, so fetching the flake-utils input 401s. Anonymous works.
+          env -u GITHUB_TOKEN -u GH_TOKEN -u JAVA_HOME \
+            devbox run -- flutter build apk --release --flavor prod
 
       - name: Create Forgejo Release and upload APK
         env: