diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 2568743..f16ac06 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -17,7 +17,6 @@ jobs:
   metadata:
     runs-on: ubuntu-latest
     outputs:
-      matrix: ${{ steps.release.outputs.matrix }}
       version: ${{ steps.release.outputs.version }}
     steps:
       - uses: actions/checkout@v4
@@ -42,10 +41,12 @@ jobs:
           done < <(git tag --list "${tag_prefix}*")
           patch=$((latest_patch + 1))
           version="${major}.${minor}.${patch}"
-          matrix="$(jq -c '{include: .targets}' .gitea/release-targets.json)"
-          jq -e '.targets | length > 0' .gitea/release-targets.json >/dev/null
+          jq -e '
+            (.targets | length > 0) and
+            ([.targets[].architecture] | length == (unique | length)) and
+            all(.targets[]; (.architecture | type == "string" and test("^[A-Za-z0-9_-]+$")))
+          ' .gitea/release-targets.json >/dev/null
           printf 'version=%s\n' "$version" >>"$GITHUB_OUTPUT"
-          printf 'matrix=%s\n' "$matrix" >>"$GITHUB_OUTPUT"
 
   create-release:
     needs: metadata
@@ -68,26 +69,23 @@ jobs:
   build:
     needs: [metadata, create-release]
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJSON(needs.metadata.outputs.matrix) }}
     steps:
       - uses: actions/checkout@v4
       - name: Install SDK build dependencies
         run: |
           sudo apt-get update
           sudo apt-get install --yes build-essential clang flex bison g++ gawk gettext git libncurses-dev libssl-dev python3 rsync unzip zlib1g-dev file wget patch time curl jq zstd
-      - name: Build ${{ matrix.architecture }} package
-        env:
-          ARCHITECTURE: ${{ matrix.architecture }}
-          VERSION: ${{ needs.metadata.outputs.version }}
-        run: scripts/ci/build-release.sh .gitea/release-targets.json "$ARCHITECTURE" "$VERSION" dist
-      - name: Upload package to draft release
+      - name: Build and upload configured packages
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           RELEASE_ID: ${{ needs.create-release.outputs.release-id }}
-          ASSET: dist/openUniFi-${{ matrix.architecture }}-${{ needs.metadata.outputs.version }}.apk
-        run: scripts/ci/gitea-release.sh upload
+          VERSION: ${{ needs.metadata.outputs.version }}
+        run: |
+          set -euo pipefail
+          while IFS= read -r architecture; do
+            scripts/ci/build-release.sh .gitea/release-targets.json "$architecture" "$VERSION" dist
+            ASSET="dist/openUniFi-${architecture}-${VERSION}.apk" scripts/ci/gitea-release.sh upload
+          done < <(jq -r '.targets[].architecture' .gitea/release-targets.json)
 
   publish-release:
     needs: [metadata, create-release, build]
diff --git a/README.md b/README.md
index 5962c81..5b25001 100644
--- a/README.md
+++ b/README.md
@@ -57,8 +57,9 @@ an incomplete set.
 
 Targets and the pinned OpenWrt release live in `.gitea/release-targets.json`.
 Add an object with a unique `architecture` label and a valid OpenWrt
-`target`/`subtarget` pair to extend the matrix. The generic ARM entries select
-ARMv7 and ARMv8 ABIs; use a device-specific OpenWrt target when necessary.
+`target`/`subtarget` pair to extend the build list; no workflow change is
+required. The generic ARM entries select ARMv7 and ARMv8 ABIs; use a
+device-specific OpenWrt target when necessary.
 
 Releases use the next available `MAJOR.MINOR.PATCH` tag. `MAJOR` and `MINOR`
 live in the release config; the workflow finds the highest existing