diff --git a/.gitea/workflows/testflight.yml b/.gitea/workflows/testflight.yml
index 3813306..b2fa7cd 100644
--- a/.gitea/workflows/testflight.yml
+++ b/.gitea/workflows/testflight.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   testflight:
-    runs-on: xcode
+    runs-on: macos-arm64
     defaults:
       run:
         shell: bash
@@ -33,10 +33,17 @@ jobs:
             brew install xcodegen
           fi
 
+      - name: Runner diagnostics
+        run: |
+          set -euo pipefail
+          whoami
+          printf 'HOME=%s\n' "$HOME"
+          security default-keychain -d user || true
+          security list-keychains -d user || true
+
       - name: Upload to TestFlight
         working-directory: ios
         env:
-          HOME: /var/lib/act_runner
           APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
           APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}
@@ -47,6 +54,5 @@ jobs:
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
         run: |
-          export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}"
           ruby --version
           bundle exec fastlane ios beta
diff --git a/ios/fastlane/Fastfile b/ios/fastlane/Fastfile
index 1e8b481..6047fdd 100644
--- a/ios/fastlane/Fastfile
+++ b/ios/fastlane/Fastfile
@@ -6,9 +6,6 @@ APP_IDENTIFIER = "net.buzzert.sybil2"
 SCHEME = "Sybil"
 TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
-CI_KEYCHAIN_NAME = "sybil_ci_keychain"
-CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -71,23 +68,20 @@ platform :ios do
     )
   end
 
-  # CI has no login keychain, so create a dedicated throwaway one for match to
-  # import the distribution cert into. The runner's launchd job sets
-  # SessionCreate, so add_to_search_list actually makes it visible to xcodebuild.
+  # CI uses a throwaway keychain that is deleted after the lane exits.
   private_lane :prepare_ci_keychain do
-    next unless ci?
+    next nil unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
-    create_keychain(
-      name: CI_KEYCHAIN_NAME,
-      password: CI_KEYCHAIN_PASSWORD,
-      unlock: true,
-      timeout: 3600,
-      add_to_search_list: true
+    run_token = "#{Time.now.to_i}_#{Process.pid}"
+    keychain_name = "fastlane_ci_#{run_token}"
+
+    setup_ci(
+      force: true,
+      keychain_name: keychain_name,
+      timeout: 7_200
     )
 
-    ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
-    ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
+    keychain_name
   end
 
   private_lane :sync_signing do |options|
@@ -112,42 +106,50 @@ platform :ios do
 
   desc "Build and upload to TestFlight"
   lane :beta do
-    prepare_ci_keychain
+    ci_keychain_name = nil
 
-    api_key = app_store_api_key
+    begin
+      ci_keychain_name = prepare_ci_keychain
 
-    version = release_version
-    stamp_marketing_version(version)
-    sh("xcodegen", "--spec", PROJECT_SPEC)
+      api_key = app_store_api_key
 
-    increment_version_number(version_number: version, xcodeproj: PROJECT_FILE)
-    increment_build_number(build_number: build_number, xcodeproj: PROJECT_FILE)
+      version = release_version
+      stamp_marketing_version(version)
+      sh("xcodegen", "--spec", PROJECT_SPEC)
 
-    sync_signing(api_key: api_key, readonly: true)
+      increment_version_number(version_number: version, xcodeproj: PROJECT_FILE)
+      increment_build_number(build_number: build_number, xcodeproj: PROJECT_FILE)
 
-    build_app(
-      project: PROJECT_FILE,
-      scheme: SCHEME,
-      export_method: "app-store",
-      codesigning_identity: "Apple Distribution",
-      xcargs: [
-        "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
-        "CODE_SIGN_STYLE=Manual",
-        "CODE_SIGN_IDENTITY=Apple\\ Distribution",
-        "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
-      ].join(" "),
-      export_options: {
-        signingStyle: "manual",
-        teamID: TEAM_ID,
-        provisioningProfiles: {
-          APP_IDENTIFIER => PROFILE_NAME
+      sync_signing(api_key: api_key, readonly: true)
+
+      sh("security find-identity -v -p codesigning") if ci_keychain_name
+
+      build_app(
+        project: PROJECT_FILE,
+        scheme: SCHEME,
+        export_method: "app-store",
+        codesigning_identity: "Apple Distribution",
+        xcargs: [
+          "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
+          "CODE_SIGN_STYLE=Manual",
+          "CODE_SIGN_IDENTITY=Apple\\ Distribution",
+          "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
+        ].join(" "),
+        export_options: {
+          signingStyle: "manual",
+          teamID: TEAM_ID,
+          provisioningProfiles: {
+            APP_IDENTIFIER => PROFILE_NAME
+          }
         }
-      }
-    )
+      )
 
-    upload_to_testflight(
-      api_key: api_key,
-      skip_waiting_for_build_processing: true
-    )
+      upload_to_testflight(
+        api_key: api_key,
+        skip_waiting_for_build_processing: true
+      )
+    ensure
+      delete_keychain(name: ci_keychain_name) if ci_keychain_name
+    end
   end
 end