diff --git a/.gitea/workflows/custom-release.yml b/.gitea/workflows/custom-release.yml
index 6f2a454d1..2887a6fb9 100644
--- a/.gitea/workflows/custom-release.yml
+++ b/.gitea/workflows/custom-release.yml
@@ -58,6 +58,15 @@ jobs:
           keychain_password="$(openssl rand -hex 24)"
           certificate_path="$RUNNER_TEMP/developer-id-application.p12"
 
+          if [ -z "$DEVELOPER_ID_APPLICATION_P12_BASE64" ]; then
+            echo "DEVELOPER_ID_APPLICATION_P12_BASE64 secret is required" >&2
+            exit 1
+          fi
+          if [ -z "$DEVELOPER_ID_APPLICATION_P12_PASSWORD" ]; then
+            echo "DEVELOPER_ID_APPLICATION_P12_PASSWORD secret is required" >&2
+            exit 1
+          fi
+
           printf '%s' "$DEVELOPER_ID_APPLICATION_P12_BASE64" | base64 -D > "$certificate_path"
           security create-keychain -p "$keychain_password" "$keychain_path"
           security set-keychain-settings -lut 21600 "$keychain_path"
diff --git a/scripts/tests/test-custom-release-macos-runner.bats b/scripts/tests/test-custom-release-macos-runner.bats
index 381ebfaa6..3186cca8a 100644
--- a/scripts/tests/test-custom-release-macos-runner.bats
+++ b/scripts/tests/test-custom-release-macos-runner.bats
@@ -24,6 +24,12 @@ setup() {
 	run rg -n 'DEVELOPER_ID_APPLICATION_P12_PASSWORD' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
+	run rg -n 'DEVELOPER_ID_APPLICATION_P12_BASE64 secret is required' "$WORKFLOW"
+	[ "$status" -eq 0 ]
+
+	run rg -n 'DEVELOPER_ID_APPLICATION_P12_PASSWORD secret is required' "$WORKFLOW"
+	[ "$status" -eq 0 ]
+
 	run rg -n 'security create-keychain' "$WORKFLOW"
 	[ "$status" -eq 0 ]