diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8eeee37c..20b323c6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,7 +93,7 @@ jobs:
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY_P8 || secrets.APPLE_API_KEY }}
           APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER_ID || secrets.APPLE_API_ISSUER }}
-          TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          TEAM_ID: ${{ secrets.APPLE_TEAM_ID || vars.APPLE_TEAM_ID }}
           SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
         run: |
           for name in CERTIFICATE_P12 CERTIFICATE_PASSWORD APPLE_API_KEY APPLE_API_KEY_ID APPLE_API_ISSUER TEAM_ID SPARKLE_PRIVATE_KEY; do
diff --git a/RELEASING.md b/RELEASING.md
index 1f0b2a41..057a80b0 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -23,13 +23,16 @@ from a dirty or unverified source state.
 - `APPLE_API_KEY_P8`
 - `APPLE_API_KEY_ID`
 - `APPLE_API_ISSUER_ID`
-- `APPLE_TEAM_ID`
 - `SPARKLE_PRIVATE_KEY`
 
 For the first Lua release, the workflow also accepts the existing legacy
 aliases `MACOS_CERTIFICATE_P12`, `APPLE_API_KEY`, and `APPLE_API_ISSUER`.
 Migrate those values to the preferred names above before removing the aliases.
 
+## Required repository variables
+
+- `APPLE_TEAM_ID`
+
 `PHI_FRAMEWORK_VERSION` remains an optional repository variable. Any version
 other than the repository default also requires `PHI_FRAMEWORK_SHA256` and
 may use `PHI_FRAMEWORK_URL`. The release refuses an unpinned framework.