diff --git a/.github/workflows/migrate-release-secrets.yml b/.github/workflows/migrate-release-secrets.yml
deleted file mode 100644
index 4305d6c..0000000
--- a/.github/workflows/migrate-release-secrets.yml
+++ /dev/null
@@ -1,121 +0,0 @@
-name: Migrate Release Secrets
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: migrate-tsm-production-release-secrets
-  cancel-in-progress: false
-
-jobs:
-  migrate:
-    name: Copy release credentials into the protected environment
-    if: >-
-      github.repository == 'terraphim/terraphim-clients' &&
-      github.ref == 'refs/heads/main'
-    environment: tsm-production-release
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Install 1Password CLI
-        uses: 1password/install-cli-action@c1b138d5779f64eda6936d5caa8e754b9f3996c0 # v2
-
-      - name: Copy credentials without exposing their values
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.TERRAPHIM_AI_RELEASE_TOKEN }}
-          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
-          ZIPSIGN_PRIVATE_KEY: ${{ secrets.ZIPSIGN_PRIVATE_KEY }}
-        run: |
-          set -euo pipefail
-          set +x
-          environment=tsm-production-release
-          repository="$GITHUB_REPOSITORY"
-
-          for required in GH_TOKEN OP_SERVICE_ACCOUNT_TOKEN ZIPSIGN_PRIVATE_KEY; do
-            [ -n "${!required:-}" ] || {
-              echo "ERROR: repository migration secret $required is unavailable" >&2
-              exit 1
-            }
-          done
-
-          APPLE_ID="$(op read \
-            'op://TerraphimPlatform/apple.developer.credentials/username' \
-            --no-newline)"
-          APPLE_TEAM_ID="$(op read \
-            'op://TerraphimPlatform/apple.developer.credentials/APPLE_TEAM_ID' \
-            --no-newline)"
-          APPLE_APP_PASSWORD="$(op read \
-            'op://TerraphimPlatform/apple.developer.credentials/APPLE_APP_SPECIFIC_PASSWORD' \
-            --no-newline)"
-          CERT_BASE64="$(op read \
-            'op://TerraphimPlatform/apple.developer.certificate/base64' \
-            --no-newline)"
-          CERT_PASSWORD="$(op read \
-            'op://TerraphimPlatform/apple.developer.certificate/password' \
-            --no-newline)"
-
-          for required in APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD \
-            CERT_BASE64 CERT_PASSWORD; do
-            [ -n "${!required:-}" ] || {
-              echo "ERROR: 1Password value $required is empty" >&2
-              exit 1
-            }
-          done
-          [[ "$APPLE_ID" =~ ^[^[:space:]@]+@[^[:space:]@]+$ ]] || {
-            echo "ERROR: APPLE_ID is not an email address" >&2
-            exit 1
-          }
-          [[ "$APPLE_TEAM_ID" =~ ^[A-Z0-9]{10}$ ]] || {
-            echo "ERROR: APPLE_TEAM_ID is not a ten-character team identifier" >&2
-            exit 1
-          }
-          [[ "$APPLE_APP_PASSWORD" =~ ^[A-Za-z0-9-]{8,64}$ ]] || {
-            echo "ERROR: APPLE_APP_PASSWORD has an unexpected format" >&2
-            exit 1
-          }
-          export CERT_PASSWORD
-          # The existing Apple Developer ID certificate is a legacy PKCS#12
-          # bundle. OpenSSL 3 requires its legacy provider to read RC2-40-CBC.
-          printf '%s' "$CERT_BASE64" | base64 --decode |
-            openssl pkcs12 -legacy -in /dev/stdin \
-              -passin env:CERT_PASSWORD -noout
-
-          copy_secret() {
-            local name="$1"
-            printf '%s' "${!name}" |
-              gh secret set "$name" --repo "$repository" --env "$environment"
-          }
-
-          copy_secret APPLE_ID
-          copy_secret APPLE_TEAM_ID
-          copy_secret APPLE_APP_PASSWORD
-          copy_secret CERT_BASE64
-          copy_secret CERT_PASSWORD
-          copy_secret ZIPSIGN_PRIVATE_KEY
-
-          expected="$(printf '%s\n' \
-            APPLE_APP_PASSWORD APPLE_ID APPLE_TEAM_ID CERT_BASE64 CERT_PASSWORD \
-            ZIPSIGN_PRIVATE_KEY | LC_ALL=C sort)"
-          actual="$(gh secret list --repo "$repository" --env "$environment" \
-            --json name --jq '.[].name' | LC_ALL=C sort)"
-          [ "$actual" = "$expected" ] || {
-            echo "ERROR: protected environment secret inventory is incomplete" >&2
-            exit 1
-          }
-
-          # Remove the reusable migration inputs only after the target inventory
-          # is complete. A later dispatch therefore fails closed before mutation.
-          for source_secret in OP_SERVICE_ACCOUNT_TOKEN ZIPSIGN_PRIVATE_KEY \
-            TERRAPHIM_AI_RELEASE_TOKEN; do
-            gh secret delete "$source_secret" --repo "$repository"
-          done
-          repository_secrets="$(gh secret list --repo "$repository" --json name)"
-          for removed in OP_SERVICE_ACCOUNT_TOKEN ZIPSIGN_PRIVATE_KEY \
-            TERRAPHIM_AI_RELEASE_TOKEN; do
-            jq -e --arg name "$removed" \
-              'all(.[]; .name != $name)' <<<"$repository_secrets" >/dev/null
-          done
-          echo "Protected release secrets migrated; reusable source path retired."