diff --git a/hosts/ios/.github/workflows/collect_prs_summary.yml b/.github/workflows/ios-collect-prs-summary.yml
similarity index 58%
rename from hosts/ios/.github/workflows/collect_prs_summary.yml
rename to .github/workflows/ios-collect-prs-summary.yml
index c4ec31d09..081d3f36b 100644
--- a/hosts/ios/.github/workflows/collect_prs_summary.yml
+++ b/.github/workflows/ios-collect-prs-summary.yml
@@ -8,8 +8,11 @@ on:
         required: false
         default: 30
         type: number
-  schedule:
-    - cron: "0 7 1 * *" # 1st of every month at 08:00 CET (UTC+1)
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   schedule:
+#     - cron: "0 7 1 * *" # 1st of every month at 08:00 CET (UTC+1)
 
 jobs:
   pr-summary:
diff --git a/hosts/ios/.github/workflows/firebase_debug_distribution.yml b/.github/workflows/ios-firebase-debug-distribution.yml
similarity index 83%
rename from hosts/ios/.github/workflows/firebase_debug_distribution.yml
rename to .github/workflows/ios-firebase-debug-distribution.yml
index 94b68dd56..1a553caf0 100644
--- a/hosts/ios/.github/workflows/firebase_debug_distribution.yml
+++ b/.github/workflows/ios-firebase-debug-distribution.yml
@@ -10,10 +10,13 @@ on:
       releaseNotes:
         description: "Release notes for the distribution"
         required: true
-  pull_request:
-    types: [closed]
-    branches:
-      - develop
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   pull_request:
+#     types: [closed]
+#     branches:
+#       - develop
 
 env:
   IOS_BUNDLE_ID: "io.parity.polkadotapp.develop"
@@ -60,7 +63,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RO_PAT }}
@@ -68,20 +71,21 @@ jobs:
       - name: Set Bundle ID and Profile if triggered by workflow_dispatch
         if: github.event_name == 'workflow_dispatch'
         run: |
-          echo "FIREBASE_GROUPS=${{ inputs.groups }}" >> $GITHUB_ENV
-          echo "RELEASE_NOTES=${{ inputs.releaseNotes }}" >> $GITHUB_ENV
+          echo "FIREBASE_GROUPS=${{ inputs.groups }}" >> "$GITHUB_ENV"
+          echo "RELEASE_NOTES=${{ inputs.releaseNotes }}" >> "$GITHUB_ENV"
 
       - name: Calculate build number
         id: build_number
         run: |
           BUILD_NUMBER=$((10100 + ${{ github.run_number }}))
-          echo "BUILD_NUMBER=${BUILD_NUMBER}" >> $GITHUB_ENV
-          echo "build_number=${BUILD_NUMBER}" >> $GITHUB_OUTPUT
+          echo "BUILD_NUMBER=${BUILD_NUMBER}" >> "$GITHUB_ENV"
+          echo "build_number=${BUILD_NUMBER}" >> "$GITHUB_OUTPUT"
           echo "Calculated build number: ${BUILD_NUMBER}"
 
       - name: Update build number
         env:
           PBXPROJ_PATH: polkadot-app.xcodeproj/project.pbxproj
+        working-directory: hosts/ios
         run: |
           set -euo pipefail
 
@@ -94,6 +98,7 @@ jobs:
         id: read_version
         env:
           PBXPROJ_PATH: polkadot-app.xcodeproj/project.pbxproj
+        working-directory: hosts/ios
         run: |
           set -euo pipefail
 
@@ -101,24 +106,25 @@ jobs:
           MARKETING_VERSION=$(python3 .github/scripts/read_versions.py "${PBXPROJ_PATH}" \
             --config-name "DevCI" \
             --output-format env | grep "marketing_version=" | cut -d'=' -f2)
-          echo "marketing_version=${MARKETING_VERSION}" >> $GITHUB_OUTPUT
-          echo "MARKETING_VERSION=${MARKETING_VERSION}" >> $GITHUB_ENV
+          echo "marketing_version=${MARKETING_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "MARKETING_VERSION=${MARKETING_VERSION}" >> "$GITHUB_ENV"
 
       - name: Add extra Swift flags to xcconfig
         if: matrix.variant.extra_swift_flags != ''
+        working-directory: hosts/ios
         run: |
           python3 .github/scripts/add_swift_flags.py \
             "polkadot-app/Configs/polkadot-app.devci.xcconfig" \
             "${{ matrix.variant.extra_swift_flags }}"
 
       - name: Configure Google services
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ secrets.GOOGLE_SERVICE_INFO_DEV_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
@@ -131,6 +137,7 @@ jobs:
           FIREBASE_APP_ID: ${{ secrets.FIREBASE_APP_ID }}
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        working-directory: hosts/ios
         run: |
           bundle exec fastlane distribute_app_to_firebase release_notes:"$FL_RELEASE_NOTES"
 
@@ -139,6 +146,7 @@ jobs:
         env:
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        working-directory: hosts/ios
         run: |
           bundle exec fastlane build_app_ci
 
@@ -147,7 +155,7 @@ jobs:
         if: always()
         with:
           name: polkadot-app-debug-ipa${{ matrix.variant.s3_suffix }}
-          path: "*.ipa"
+          path: "hosts/ios/*.ipa"
           retention-days: 7
 
       - name: Upload to S3
@@ -157,7 +165,7 @@ jobs:
           s3_access_key: ${{ secrets.SCW_ACCESS_KEY }}
           s3_secret_key: ${{ secrets.SCW_SECRET_KEY }}
           s3_bucket: ${{ env.S3_BUCKET }}
-          source_path: polkadot-app.ipa
+          source_path: hosts/ios/polkadot-app.ipa
           destination_path: /ios/develop/polkadot-app-${{ env.MARKETING_VERSION }}-${{ env.BUILD_NUMBER }}${{ matrix.variant.s3_suffix }}.ipa
 
       - name: Upload to S3 (static path)
@@ -167,5 +175,5 @@ jobs:
           s3_access_key: ${{ secrets.SCW_ACCESS_KEY }}
           s3_secret_key: ${{ secrets.SCW_SECRET_KEY }}
           s3_bucket: ${{ env.S3_BUCKET }}
-          source_path: polkadot-app.ipa
+          source_path: hosts/ios/polkadot-app.ipa
           destination_path: /ios/develop/polkadot-app${{ matrix.variant.s3_suffix }}.ipa
diff --git a/hosts/ios/.github/workflows/nightly_prepare.yml b/.github/workflows/ios-nightly-prepare.yml
similarity index 72%
rename from hosts/ios/.github/workflows/nightly_prepare.yml
rename to .github/workflows/ios-nightly-prepare.yml
index 28e4701de..f231df5ca 100644
--- a/hosts/ios/.github/workflows/nightly_prepare.yml
+++ b/.github/workflows/ios-nightly-prepare.yml
@@ -17,8 +17,11 @@ on:
         type: string
         required: false
         default: ""
-  schedule:
-    - cron: "0 16 * * 1-5" # 16:00 UTC Monday-Friday
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   schedule:
+#     - cron: "0 16 * * 1-5" # 16:00 UTC Monday-Friday
 
 permissions:
   contents: write
@@ -27,7 +30,7 @@ permissions:
 
 jobs:
   prepare:
-    uses: ./.github/workflows/_prepare_pipeline.yml
+    uses: ./.github/workflows/ios-prepare-pipeline.yml
     with:
       is_nightly: true
       bump_level: "no-bump"
diff --git a/hosts/ios/.github/workflows/nightly_simulator_release.yml b/.github/workflows/ios-nightly-simulator-release.yml
similarity index 81%
rename from hosts/ios/.github/workflows/nightly_simulator_release.yml
rename to .github/workflows/ios-nightly-simulator-release.yml
index 8deb1d73e..f5ad1d12c 100644
--- a/hosts/ios/.github/workflows/nightly_simulator_release.yml
+++ b/.github/workflows/ios-nightly-simulator-release.yml
@@ -14,11 +14,14 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  schedule:
-    # 02:30 UTC — runs after the nightly Firebase distribution on develop
-    # (typically completes by ~01:00 UTC after the day's last merge), so
-    # the simulator artifact reflects the same code that Firebase shipped.
-    - cron: "30 2 * * *"
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   schedule:
+#     # 02:30 UTC — runs after the nightly Firebase distribution on develop
+#     # (typically completes by ~01:00 UTC after the day's last merge), so
+#     # the simulator artifact reflects the same code that Firebase shipped.
+#     - cron: "30 2 * * *"
   workflow_dispatch:
 
 permissions:
@@ -39,21 +42,22 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
 
       - name: Configure Google services
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ secrets.GOOGLE_SERVICE_INFO_RELEASE_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
 
       - name: Build simulator .app
+        working-directory: hosts/ios
         run: bundle exec fastlane build_app_simulator
 
       - name: Compute release tag + name
@@ -71,12 +75,13 @@ jobs:
 
       - name: Zip .app bundle
         id: zip
+        working-directory: hosts/ios
         run: |
           set -euo pipefail
           cd build_simulator
           # `.app` is a directory bundle; zip preserves the structure so
           # consumers can unzip and `xcrun simctl install` the result.
-          APP_DIR=$(ls -d *.app | head -1)
+          APP_DIR=$(ls -d ./*.app | head -1)
           if [ -z "$APP_DIR" ]; then
             echo "::error::No .app directory found under build_simulator/"
             exit 1
@@ -84,7 +89,7 @@ jobs:
           ARCHIVE="polkadot-app-simulator.app.zip"
           zip -ry "$ARCHIVE" "$APP_DIR"
           ls -la "$ARCHIVE"
-          echo "archive=build_simulator/$ARCHIVE" >> "$GITHUB_OUTPUT"
+          echo "archive=hosts/ios/build_simulator/$ARCHIVE" >> "$GITHUB_OUTPUT"
 
       - name: Publish GitHub Release
         uses: softprops/action-gh-release@v2
diff --git a/hosts/ios/.github/workflows/pr.yml b/.github/workflows/ios-pr.yml
similarity index 87%
rename from hosts/ios/.github/workflows/pr.yml
rename to .github/workflows/ios-pr.yml
index 071c169b8..0f41b29f7 100644
--- a/hosts/ios/.github/workflows/pr.yml
+++ b/.github/workflows/ios-pr.yml
@@ -5,7 +5,11 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  pull_request:
+  workflow_dispatch:
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   pull_request:
 
 permissions:
   contents: read
@@ -52,19 +56,19 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RO_PAT }}
 
       - name: Configure Google services
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ secrets.GOOGLE_SERVICE_INFO_DEV_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
@@ -73,6 +77,7 @@ jobs:
         env:
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        working-directory: hosts/ios
         run: |
           # Pass debug flag to fastlane if DEBUG_CI is enabled
           if [ "${{ env.DEBUG_CI }}" = "true" ]; then
@@ -87,6 +92,7 @@ jobs:
       - name: Warning ratchet
         id: ratchet
         continue-on-error: true
+        working-directory: hosts/ios
         run: |
           Runscripts/extract_xcresult.sh \
             --out current_warnings.json \
@@ -127,7 +133,7 @@ jobs:
         with:
           name: build-artifacts-${{ github.run_number }}
           path: |
-            ./fastlane/build_logs/
+            hosts/ios/fastlane/build_logs/
           retention-days: 3
 
   test:
@@ -138,21 +144,22 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
 
       - name: Configure Google services
-        uses: ./.github/actions/configure-google-services
+        uses: ./hosts/ios/.github/actions/configure-google-services
         with:
           google_service_info_base64: ${{ secrets.GOOGLE_SERVICE_INFO_DEV_BASE64 }}
           expected_bundle_id: ${{ env.IOS_BUNDLE_ID }}
 
       - name: Configure secrets
-        uses: ./.github/actions/configure-secrets
+        uses: ./hosts/ios/.github/actions/configure-secrets
         with:
           sentry_dsn: ${{ secrets.SENTRY_DSN }}
           meld_basic_auth_token: ${{ secrets.MELD_BASIC_AUTH_TOKEN }}
 
       - name: Run tests
+        working-directory: hosts/ios
         run: |
           # Pass debug flag to fastlane if DEBUG_CI is enabled
           if [ "${{ env.DEBUG_CI }}" = "true" ]; then
@@ -169,6 +176,6 @@ jobs:
         with:
           name: test-artifacts-${{ github.run_number }}
           path: |
-            ./fastlane/test_output/
-            ./fastlane/build_logs/
+            hosts/ios/fastlane/test_output/
+            hosts/ios/fastlane/build_logs/
           retention-days: 3
diff --git a/hosts/ios/.github/workflows/release_branch_lifecycle.yml b/.github/workflows/ios-release-branch-lifecycle.yml
similarity index 94%
rename from hosts/ios/.github/workflows/release_branch_lifecycle.yml
rename to .github/workflows/ios-release-branch-lifecycle.yml
index 8a78a6089..392173423 100644
--- a/hosts/ios/.github/workflows/release_branch_lifecycle.yml
+++ b/.github/workflows/ios-release-branch-lifecycle.yml
@@ -1,10 +1,14 @@
 name: Release Branch Lifecycle
 
 on:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
+  workflow_dispatch:
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   pull_request:
+#     types: [closed]
+#     branches:
+#       - main
 
 permissions:
   contents: write
diff --git a/hosts/ios/.github/workflows/release_distribution.yml b/.github/workflows/ios-release-distribution.yml
similarity index 88%
rename from hosts/ios/.github/workflows/release_distribution.yml
rename to .github/workflows/ios-release-distribution.yml
index 0488582a5..1e856557c 100644
--- a/hosts/ios/.github/workflows/release_distribution.yml
+++ b/.github/workflows/ios-release-distribution.yml
@@ -1,10 +1,13 @@
 name: Release Distribution
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches:
-      - main
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   pull_request:
+#     types: [opened, synchronize, reopened]
+#     branches:
+#       - main
   workflow_dispatch:
     inputs:
       release_branch:
@@ -30,7 +33,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (startsWith(github.head_ref, 'release/') &&
        !contains(github.event.pull_request.body, 'nightly_build=true'))
-    uses: ./.github/workflows/_build_distribute.yml
+    uses: ./.github/workflows/ios-build-distribute.yml
     with:
       release_branch: ${{ inputs.release_branch || github.head_ref }}
       release_pr_number: ${{ inputs.release_pr_number || github.event.pull_request.number || '' }}
diff --git a/hosts/ios/.github/workflows/update_signing_data.yml b/.github/workflows/ios-update-signing-data.yml
similarity index 69%
rename from hosts/ios/.github/workflows/update_signing_data.yml
rename to .github/workflows/ios-update-signing-data.yml
index a91cb8f87..4f1a4090b 100644
--- a/hosts/ios/.github/workflows/update_signing_data.yml
+++ b/.github/workflows/ios-update-signing-data.yml
@@ -6,8 +6,11 @@ concurrency:
 
 on:
   workflow_dispatch:
-  schedule:
-    - cron: "0 10 * * *" # 10:00 AM every day
+  # Held on workflow_dispatch until the build credentials tracked in #672
+  # land. The trigger below is the one this workflow runs on; restoring it
+  # is the change that puts this workflow live.
+#   schedule:
+#     - cron: "0 10 * * *" # 10:00 AM every day
 
 jobs:
   update_signing_data:
@@ -16,12 +19,13 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup iOS Environment
-        uses: ./.github/actions/install
+        uses: ./hosts/ios/.github/actions/install
         with:
           match_auth_required: "true"
           match_repository_pat: ${{ secrets.FASTLANE_RW_PAT }}
 
       - name: Update signing data
+        working-directory: hosts/ios
         run: bundle exec fastlane update_signing_data
         env:
           ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}