diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6eee26c..ac5187a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -46,12 +46,14 @@ jobs:
           gpg --quiet --output $GITHUB_WORKSPACE/release.gpg --dearmor ./release.asc
 
           echo "Build and publish"
-          sed -i -e "s,mavenCentralUsername=,mavenCentralUsername=$SONATYPE_TOKEN_USERNAME,g" gradle.properties
-          SONATYPE_TOKEN_PASSWORD_ESCAPED=$(printf '%s\n' "$SONATYPE_TOKEN_PASSWORD" | sed -e 's/[\/&]/\\&/g')
-          sed -i -e "s,mavenCentralPassword=,mavenCentralPassword=$SONATYPE_TOKEN_PASSWORD_ESCAPED,g" gradle.properties
-          sed -i -e "s,signing.keyId=,signing.keyId=$GPG_KEY_ID,g" gradle.properties
-          sed -i -e "s,signing.password=,signing.password=$GPG_PASSWORD,g" gradle.properties
-          sed -i -e "s,signing.secretKeyRingFile=,signing.secretKeyRingFile=$GITHUB_WORKSPACE/release.gpg,g" gradle.properties
+          {
+            echo
+            printf 'mavenCentralUsername=%s\n' "$SONATYPE_TOKEN_USERNAME"
+            printf 'mavenCentralPassword=%s\n' "$SONATYPE_TOKEN_PASSWORD"
+            printf 'signing.keyId=%s\n' "$GPG_KEY_ID"
+            printf 'signing.password=%s\n' "$GPG_PASSWORD"
+            printf 'signing.secretKeyRingFile=%s\n' "$GITHUB_WORKSPACE/release.gpg"
+          } >> gradle.properties
         env:
           GPG_KEY_ARMOR: ${{ secrets.SYNCED_GPG_KEY_ARMOR }}
           GPG_KEY_ID: ${{ secrets.SYNCED_GPG_KEY_ID }}
diff --git a/gradle.properties b/gradle.properties
index 6818969..cea2c23 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -24,12 +24,9 @@ android.useAndroidX=true
 # Kotlin code style for this project: "official" or "obsolete":
 kotlin.code.style=official
 
-mavenCentralUsername=
-mavenCentralPassword=
-
-signing.keyId=
-signing.password=
-signing.secretKeyRingFile=
+# Maven Central and signing credentials are not set here. Pass them through
+# ~/.gradle/gradle.properties or ORG_GRADLE_PROJECT_* environment variables;
+# the publish workflow appends them in CI.
 
 # Enables namespacing of each library's R class so that its R class includes only the
 # resources declared in the library itself and none from the library's dependencies,