diff --git a/.github/workflows/desktop-bundled-release.yml b/.github/workflows/desktop-bundled-release.yml
index 0f49aa14e3..0449f7ba59 100644
--- a/.github/workflows/desktop-bundled-release.yml
+++ b/.github/workflows/desktop-bundled-release.yml
@@ -665,6 +665,8 @@ jobs:
           [ -z "$APPLE_API_KEY_P8" ] && missing+=(APPLE_API_KEY_P8)
           [ -z "$APPLE_API_KEY_ID" ] && missing+=(APPLE_API_KEY_ID)
           [ -z "$APPLE_API_ISSUER" ] && missing+=(APPLE_API_ISSUER)
+          [ -z "$CLOUDFLARE_R2_PUBLIC_URL" ] && missing+=(CLOUDFLARE_R2_PUBLIC_URL)
+          [ -z "$CLOUDFLARE_R2_BUCKET" ] && missing+=(CLOUDFLARE_R2_BUCKET)
           if [ ${#missing[@]} -gt 0 ]; then
             echo "::error::upload_release=true but required signing/notarization credentials are not set in the release-signing environment: ${missing[*]} — refusing to produce an unsigned publishable build"
             exit 1
diff --git a/scripts/r2-release.mjs b/scripts/r2-release.mjs
index ae3568f71d..2dbcb5e075 100644
--- a/scripts/r2-release.mjs
+++ b/scripts/r2-release.mjs
@@ -22,7 +22,7 @@
 //     releases/win32/<channel>/*.msixbundle           (produced by the
 //                                                     publish-win32-updater job)
 //   releases/darwin/<channel>/<channel>-mac.yml   electron-updater feed
-//     releases/darwin/<channel>/*.{dmg,zip,blockmap}
+//     dmg/zip/blockmap artifacts stay in releases/tag/<tag>/.
 // where <channel> is stable | canary (from the tag: -canary. → canary).
 // The publish-win32-updater job merges the win32 legs' staging into the
 // win32 feed; r2 finalize publishes the validated Darwin channel feed.