diff --git a/.github/workflows/frontend-admin-build.yml b/.github/workflows/frontend-admin-build.yml
index 5e7da81b..eb6abbf5 100644
--- a/.github/workflows/frontend-admin-build.yml
+++ b/.github/workflows/frontend-admin-build.yml
@@ -83,6 +83,19 @@ jobs:
                   jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID }}"' app.json > app.tmp.json
                   mv app.tmp.json app.json
 
+            - name: Select code signing certificate
+              # certs/certificate.pem (committé) correspond à la clé de signature
+              # du serveur OTA de production ; le serveur pre-prod signe avec une
+              # clé différente (PRIVATE_KEY_PREPROD côté ota-uber), donc les builds
+              # pre-prod doivent embarquer certs/certificate-preprod.pem à la place,
+              # sous peine de voir toute MAJ OTA rejetée silencieusement (signature
+              # invalide) sur ce canal.
+              working-directory: frontend-admin
+              run: |
+                  if [ "${{ steps.config.outputs.profile }}" = "pre-prod" ]; then
+                    cp certs/certificate-preprod.pem certs/certificate.pem
+                  fi
+
             - name: Restore Gradle cache (RustFS)
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
diff --git a/.github/workflows/frontend-client-build.yml b/.github/workflows/frontend-client-build.yml
index 39b5ce82..af2b354c 100644
--- a/.github/workflows/frontend-client-build.yml
+++ b/.github/workflows/frontend-client-build.yml
@@ -83,6 +83,19 @@ jobs:
                   jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID_CLIENT }}"' app.json > app.tmp.json
                   mv app.tmp.json app.json
 
+            - name: Select code signing certificate
+              # certs/certificate.pem (committé) correspond à la clé de signature
+              # du serveur OTA mobile de production ; le serveur pre-prod signe
+              # avec une clé différente (PRIVATE_KEY_MOBILE_PREPROD côté ota-uber),
+              # donc les builds pre-prod doivent embarquer
+              # certs/certificate-preprod.pem à la place, sous peine de voir toute
+              # MAJ OTA rejetée silencieusement (signature invalide) sur ce canal.
+              working-directory: mobile
+              run: |
+                  if [ "${{ steps.config.outputs.profile }}" = "pre-prod" ]; then
+                    cp certs/certificate-preprod.pem certs/certificate.pem
+                  fi
+
             - name: Restore Gradle cache (RustFS)
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
@@ -99,7 +112,7 @@ jobs:
                   EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.xavia_url }}
                   EAS_BUILD_NO_EXPO_GO_WARNING: true
                   NODE_OPTIONS: "--max-old-space-size=2048"
-                  GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx3g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true -Dorg.gradle.workers.max=2"
+                  GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx3g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true -Dorg.gradle.workers.max=2 -Dorg.gradle.internal.repository.max.retries=10 -Dorg.gradle.internal.repository.initial.backoff.ms=1000"
                   JAVA_TOOL_OPTIONS: "-Xmx3g"
               run: eas build --platform android --profile ${{ steps.config.outputs.profile }} --local --non-interactive