diff --git a/.gitea/workflows/build_dashboard.yaml b/.gitea/workflows/build_dashboard.yaml
index 096bed4..6570f9a 100644
--- a/.gitea/workflows/build_dashboard.yaml
+++ b/.gitea/workflows/build_dashboard.yaml
@@ -15,7 +15,7 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.gitea/workflows/build_device_agent.yaml b/.gitea/workflows/build_device_agent.yaml
index c2846c3..9ac462b 100644
--- a/.gitea/workflows/build_device_agent.yaml
+++ b/.gitea/workflows/build_device_agent.yaml
@@ -6,13 +6,6 @@ on:
 jobs:
   cross-build:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        goos: [linux, windows]
-        goarch: [amd64, arm64]
-        exclude:
-          - goos: windows
-            goarch: arm64
     steps:
       - name: Configure git auth for submodules
         run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
@@ -22,25 +15,44 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
 
-      - name: Build
+      - name: Build all platforms
         working-directory: apps/device-agent
-        env:
-          CGO_ENABLED: '0'
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
+        shell: bash
         run: |
-          EXT=""
-          if [ "${{ matrix.goos }}" = "windows" ]; then EXT=".exe"; fi
-          go build -o bin/nexus-device-agent-${{ matrix.goos }}-${{ matrix.goarch }}${EXT} .
+          set -e
+          mkdir -p bin
+          for PAIR in linux/amd64 linux/arm64 windows/amd64; do
+            GOOS="${PAIR%%/*}"
+            GOARCH="${PAIR##*/}"
+            EXT=""
+            if [ "$GOOS" = "windows" ]; then EXT=".exe"; fi
+            OUT="bin/nexus-device-agent-${GOOS}-${GOARCH}${EXT}"
+            echo "Building $OUT ..."
+            CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build -o "$OUT" .
+          done
+          echo "=== Build output ==="
+          ls -la bin/
 
-      - name: Upload artifact
+      - name: Upload linux/amd64
         uses: actions/upload-artifact@v3
         with:
-          name: nexus-device-agent-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: apps/device-agent/bin/nexus-device-agent-*
+          name: nexus-device-agent-linux-amd64
+          path: apps/device-agent/bin/nexus-device-agent-linux-amd64
+
+      - name: Upload linux/arm64
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexus-device-agent-linux-arm64
+          path: apps/device-agent/bin/nexus-device-agent-linux-arm64
+
+      - name: Upload windows/amd64
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexus-device-agent-windows-amd64
+          path: apps/device-agent/bin/nexus-device-agent-windows-amd64.exe
diff --git a/.gitea/workflows/build_server_core.yaml b/.gitea/workflows/build_server_core.yaml
index d116864..832f5f7 100644
--- a/.gitea/workflows/build_server_core.yaml
+++ b/.gitea/workflows/build_server_core.yaml
@@ -15,7 +15,7 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - uses: actions/setup-go@v5
         with:
diff --git a/.gitea/workflows/docs_call.yaml b/.gitea/workflows/docs_call.yaml
index 7f74c7d..0bca093 100644
--- a/.gitea/workflows/docs_call.yaml
+++ b/.gitea/workflows/docs_call.yaml
@@ -15,7 +15,7 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.gitea/workflows/release_call.yaml b/.gitea/workflows/release_call.yaml
index be3d938..f7a8491 100644
--- a/.gitea/workflows/release_call.yaml
+++ b/.gitea/workflows/release_call.yaml
@@ -22,7 +22,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Download all artifacts
         uses: actions/download-artifact@v3