diff --git a/.github/workflows/copy-source-to-repo.yaml b/.github/workflows/copy-source-to-repo.yaml
index 5aba604..ec3a3c1 100644
--- a/.github/workflows/copy-source-to-repo.yaml
+++ b/.github/workflows/copy-source-to-repo.yaml
@@ -81,7 +81,11 @@ jobs:
           GPG_KEY_ID: ${{ secrets.CI_BOT_GPG_KEY_ID }}
           GPG_KEY_SUBJECT: ${{ secrets.CI_BOT_GPG_KEY_SUBJECT }}
         run: |
-          echo "$GPG_KEY_BASE64" | base64 -d | gpg --batch --yes --no-tty --always-trust --import
+          # Key may be stored armored (org convention) or base64-wrapped —
+          # import directly first, fall back to decoding.
+          if ! printf '%s\n' "$GPG_KEY_BASE64" | gpg --batch --yes --no-tty --always-trust --import; then
+            printf '%s\n' "$GPG_KEY_BASE64" | base64 -d | gpg --batch --yes --no-tty --always-trust --import
+          fi
           echo "ENCRYPTION_TEST" | gpg --always-trust --encrypt --recipient "$GPG_KEY_SUBJECT" > temp.encrypted
           gpg --batch --yes --no-tty --decrypt --passphrase "$GPG_PASSPHRASE" --pinentry-mode loopback --always-trust temp.encrypted
           rm -f temp.encrypted
diff --git a/.github/workflows/update-source-reference.yaml b/.github/workflows/update-source-reference.yaml
index c864f41..5b52b40 100644
--- a/.github/workflows/update-source-reference.yaml
+++ b/.github/workflows/update-source-reference.yaml
@@ -106,7 +106,11 @@ jobs:
           GPG_KEY_ID: ${{ secrets.CI_BOT_GPG_KEY_ID }}
           GPG_KEY_SUBJECT: ${{ secrets.CI_BOT_GPG_KEY_SUBJECT }}
         run: |
-          echo "$GPG_KEY_BASE64" | base64 -d | gpg --batch --yes --no-tty --always-trust --import
+          # Key may be stored armored (org convention) or base64-wrapped —
+          # import directly first, fall back to decoding.
+          if ! printf '%s\n' "$GPG_KEY_BASE64" | gpg --batch --yes --no-tty --always-trust --import; then
+            printf '%s\n' "$GPG_KEY_BASE64" | base64 -d | gpg --batch --yes --no-tty --always-trust --import
+          fi
           echo "ENCRYPTION_TEST" | gpg --always-trust --encrypt --recipient "$GPG_KEY_SUBJECT" > temp.encrypted
           gpg --batch --yes --no-tty --decrypt --passphrase "$GPG_PASSPHRASE" --pinentry-mode loopback --always-trust temp.encrypted
           rm -f temp.encrypted