diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75b3078..099661b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,11 @@ jobs:
   release:
     runs-on: ubuntu-latest
 
+    # The secrets context is not allowed in step `if:` expressions (the whole
+    # workflow fails to parse); hoist the presence check into an env var.
+    env:
+      HAS_SIGNING_KEY: ${{ secrets.GPG_PRIVATE_KEY != '' }}
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -39,13 +44,13 @@ jobs:
       # secret is configured. Without it, a release still produces the GitHub
       # Release and attached jars above.
       - name: Set up GPG
-        if: ${{ secrets.GPG_PRIVATE_KEY != '' }}
+        if: env.HAS_SIGNING_KEY == 'true'
         run: |
           echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import
           echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --import-ownertrust
 
       - name: Deploy to Maven Central
-        if: ${{ secrets.GPG_PRIVATE_KEY != '' }}
+        if: env.HAS_SIGNING_KEY == 'true'
         run: mvn deploy -P build-cli-jar -DskipTests --settings .github/maven-settings.xml
 
       - name: Update version in pom.xml
diff --git a/pom.xml b/pom.xml
index d14d486..968cc6e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <artifactId>oashield</artifactId>
     <packaging>jar</packaging>
     <name>oashield</name>
-    <version>0.1.0</version>
+    <version>0.2.0</version>
     <build>
         <plugins>
             <plugin>