diff --git a/.github/workflows/ios.preview.build.yml b/.github/workflows/ios.preview.build.yml
index a23173c3f..592d81abe 100644
--- a/.github/workflows/ios.preview.build.yml
+++ b/.github/workflows/ios.preview.build.yml
@@ -110,6 +110,12 @@ jobs:
           cd apps/mobile/ios/build-configs
           ./use-ios-build-config.sh staging --marketing-version ${{steps.marketing-version.outputs.version}} --build-number ${{steps.build-number.outputs.timestamp}}
 
+      # Archive unsigned: this job has no certs/profiles (secrets), and the iOS
+      # device SDK forbids ad-hoc signing, so real signing must wait for publish.
+      # Do NOT pass CODE_SIGN_ENTITLEMENTS="" -- each target must keep its own
+      # entitlements file so the archive records them (App Group etc.); the
+      # publish job's -exportArchive re-signs using those. Blanking them is what
+      # dropped the App Group and crashed MMKV on launch.
       - name: Archive (unsigned)
         run: |
           set -euo pipefail
@@ -120,12 +126,9 @@ jobs:
             -sdk iphoneos \
             -destination 'generic/platform=iOS' \
             -archivePath "$RUNNER_TEMP/Notesnook.xcarchive" \
-            CODE_SIGN_IDENTITY="-" \
-            CODE_SIGN_STYLE=Manual \
+            CODE_SIGNING_ALLOWED=NO \
             CODE_SIGNING_REQUIRED=NO \
-            CODE_SIGNING_ALLOWED=YES \
-            PROVISIONING_PROFILE_SPECIFIER="" \
-            DEVELOPMENT_TEAM="" \
+            CODE_SIGN_IDENTITY="" \
             archive
 
       - name: Stage build artifact
diff --git a/.github/workflows/ios.preview.publish.yml b/.github/workflows/ios.preview.publish.yml
index d2bd57bac..43115fd61 100644
--- a/.github/workflows/ios.preview.publish.yml
+++ b/.github/workflows/ios.preview.publish.yml
@@ -95,6 +95,23 @@ jobs:
           IPA="$(find "$RUNNER_TEMP/export" -name '*.ipa' | head -n1)"
           cp "$IPA" "$RUNNER_TEMP/Notesnook.ipa"
 
+          # Fail fast if the App Group entitlement didn't survive re-signing.
+          # Its absence is what crashes the app at launch (MMKV nil group path),
+          # so never distribute a build without it.
+          WORK="$RUNNER_TEMP/verify"
+          mkdir -p "$WORK"
+          unzip -q "$RUNNER_TEMP/Notesnook.ipa" -d "$WORK"
+          APP="$(find "$WORK/Payload" -maxdepth 1 -name '*.app' | head -n1)"
+          echo "::group::Signed app entitlements"
+          codesign -d --entitlements :- "$APP" 2>/dev/null || codesign -d --entitlements - "$APP"
+          echo "::endgroup::"
+          if codesign -d --entitlements :- "$APP" 2>/dev/null | grep -q "group.org.streetwriters.notesnook"; then
+            echo "App Group entitlement present."
+          else
+            echo "::error::Exported app is missing the App Group entitlement; it would crash on launch."
+            exit 1
+          fi
+
       - name: Upload signed IPA
         uses: actions/upload-artifact@v4
         with: