diff --git a/.gitea/workflows/package-and-deploy.yaml b/.gitea/workflows/package-and-deploy.yaml
index 12c723e..2f7c879 100644
--- a/.gitea/workflows/package-and-deploy.yaml
+++ b/.gitea/workflows/package-and-deploy.yaml
@@ -34,6 +34,7 @@ jobs:
       # 4) “Generation‑1”‑Secret‑Ring für Helm erzeugen (TMP, 600 Rechte)
       - name: Build legacy secret-keyring
         run: |
+          set -euo pipefail
           install -m 700 -d /tmp/gpgring
           gpg --batch --yes --pinentry-mode loopback \
               --passphrase "$PASSPHRASE" \