diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 44b8539..b680324 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,14 +1,14 @@
 name: LogMob CI
 
 on:
+  pull_request:
   push:
     branches:
       - develop
-      - 'submodule/CCC'
-  pull_request:
+      - master
 
 jobs:
-  build:
+  ci:
 
     runs-on: macos-26
 
@@ -19,6 +19,31 @@ jobs:
       - name: Gradle Build
         run: ./gradlew build
 
+      # Publish only on a merge to develop/master, and only after the build above passes.
+      # develop -> X.Y-SNAPSHOT (unsigned), master -> X.Y.Z release (signed).
+      - name: Publish
+        if: github.event_name == 'push'
+        # Normalize the armored GPG key: literal "\n" -> real newlines (vanniktech's
+        # signingInMemoryKey needs real newlines); a correct key passes through unchanged.
+        run: |
+          export ORG_GRADLE_PROJECT_signingInMemoryKey="$(printf '%b' "$GPG_KEY_RAW")"
+          ./gradlew publishToMavenCentral --no-configuration-cache
+        env:
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_USERNAME }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_PASSWORD }}
+          GPG_KEY_RAW: ${{ secrets.GPG_KEY }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_PASSWORD }}
+
+      - name: Notify slack success
+        if: success() && github.event_name == 'push'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        uses: voxmedia/github-action-slack-notify-build@v2
+        with:
+          channel: submob
+          status: SUCCESS
+          color: good
+
       - name: Notify slack fail
         if: failure()
         env:
@@ -27,4 +52,4 @@ jobs:
         with:
           channel: submob
           status: FAILED
-          color: danger
\ No newline at end of file
+          color: danger
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index e333612..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-name: Deployment
-
-on:
-  push:
-    branches:
-      - develop  # publishes an overwritable -SNAPSHOT
-      - master   # auto-releases the permanent version to Maven Central
-
-jobs:
-  deploy:
-
-    runs-on: macos-26
-
-    steps:
-      - name: Setup Gradle Repo
-        uses: Oztechan/Global/actions/setup-gradle-repo@8610938e630b3ed86127765237fe3647b9fabd4f
-
-      - name: Publish
-        run: ./gradlew publishToMavenCentral --no-configuration-cache
-        env:
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_USERNAME }}
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_PASSWORD }}
-          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_KEY }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_PASSWORD }}
-
-      - name: Notify slack success
-        if: success()
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        uses: voxmedia/github-action-slack-notify-build@v2
-        with:
-          channel: submob
-          status: SUCCESS
-          color: good
-
-      - name: Notify slack fail
-        if: failure()
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        uses: voxmedia/github-action-slack-notify-build@v2
-        with:
-          channel: submob
-          status: FAILED
-          color: danger
\ No newline at end of file
diff --git a/logmob/logmob.gradle.kts b/logmob/logmob.gradle.kts
index e35916f..9afc3df 100644
--- a/logmob/logmob.gradle.kts
+++ b/logmob/logmob.gradle.kts
@@ -43,6 +43,9 @@ kotlin {
 
 mavenPublishing {
     // Coordinates (GROUP + POM_ARTIFACT_ID), POM, host and auto-release come from gradle.properties.
-    // Central Portal requires signed artifacts; keys are provided in CI via ORG_GRADLE_PROJECT_* env.
-    signAllPublications()
+    // Sign releases only — Central Portal snapshots aren't signed, and the signing key is provided
+    // to release CI via ORG_GRADLE_PROJECT_* env.
+    if (!version.toString().endsWith("SNAPSHOT")) {
+        signAllPublications()
+    }
 }