diff --git a/.github/scripts/inject-token.ps1 b/.github/scripts/inject-token.ps1
new file mode 100644
index 000000000..f23310325
--- /dev/null
+++ b/.github/scripts/inject-token.ps1
@@ -0,0 +1,34 @@
+param(
+    [string]$Token
+)
+
+if ([string]::IsNullOrEmpty($Token)) {
+    Write-Host "No UPLOADTHING_TOKEN provided. Skipping injection. Build will use empty/default token."
+    exit 0
+}
+
+$constantsPath = "GenHub/GenHub.Core/Constants/ApiConstants.cs"
+if (-not (Test-Path $constantsPath)) {
+    Write-Error "Could not find $constantsPath"
+    exit 1
+}
+
+$tokenBytes = [System.Text.Encoding]::UTF8.GetBytes($Token)
+$key = New-Object byte[] 32
+[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($key)
+
+$obfuscated = New-Object byte[] $tokenBytes.Length
+for ($i = 0; $i -lt $tokenBytes.Length; $i++) {
+    $obfuscated[$i] = $tokenBytes[$i] -bxor $key[$i % $key.Length]
+}
+
+$dataStr = ($obfuscated | ForEach-Object { "0x{0:x2}" -f $_ }) -join ", "
+$keyStr = ($key | ForEach-Object { "0x{0:x2}" -f $_ }) -join ", "
+
+$content = Get-Content $constantsPath -Raw
+# Replace the placeholders we put in the static property
+$content = $content -replace 'byte\[\] data = \[\]; // \[PLACEHOLDER_DATA\]', "byte[] data = [$dataStr];"
+$content = $content -replace 'byte\[\] key = \[\];  // \[PLACEHOLDER_KEY\]', "byte[] key = [$keyStr];"
+
+Set-Content $constantsPath $content
+Write-Host "Successfully injected and obfuscated UPLOADTHING_TOKEN into ApiConstants.cs"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e6cc166c4..94173ca60 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -142,6 +142,11 @@ jobs:
           Write-Host "Building Windows project"
           dotnet build "${{ env.WINDOWS_PROJECT }}" -c ${{ env.BUILD_CONFIGURATION }} @buildProps
 
+      - name: Inject Secrets
+        shell: pwsh
+        run: |
+          ./.github/scripts/inject-token.ps1 -Token "${{ secrets.UPLOADTHING_TOKEN }}"
+
       - name: Publish Windows App
         shell: pwsh
         run: |
@@ -292,6 +297,11 @@ jobs:
           echo "Building Linux project"
           dotnet build "${{ env.LINUX_PROJECT }}" -c ${{ env.BUILD_CONFIGURATION }} $BUILD_PROPS
 
+      - name: Inject Secrets
+        shell: pwsh
+        run: |
+          ./.github/scripts/inject-token.ps1 -Token "${{ secrets.UPLOADTHING_TOKEN }}"
+
       - name: Publish Linux App
         run: |
           BUILD_PROPS="-p:Version=${{ steps.buildinfo.outputs.VERSION }} -p:GitShortHash=${{ steps.buildinfo.outputs.SHORT_HASH }} -p:PullRequestNumber=${{ steps.buildinfo.outputs.PR_NUMBER }} -p:BuildChannel=${{ steps.buildinfo.outputs.CHANNEL }}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8b3aa5c6f..5b338d5e2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,26 +43,7 @@ jobs:
       - name: Inject Secrets
         shell: pwsh
         run: |
-          $constantsPath = "GenHub/GenHub.Core/Constants/ApiConstants.cs"
-          $token = "${{ secrets.UPLOADTHING_TOKEN }}"
-          if ([string]::IsNullOrEmpty($token)) { throw "UPLOADTHING_TOKEN secret is not set in GitHub Settings" }
-
-          $tokenBytes = [System.Text.Encoding]::UTF8.GetBytes($token)
-          $key = New-Object byte[] 32
-          [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($key)
-
-          $obfuscated = New-Object byte[] $tokenBytes.Length
-          for ($i = 0; $i -lt $tokenBytes.Length; $i++) {
-              $obfuscated[$i] = $tokenBytes[$i] -bxor $key[$i % $key.Length]
-          }
-
-          $dataStr = ($obfuscated | ForEach-Object { "0x{0:x2}" -f $_ }) -join ", "
-          $keyStr = ($key | ForEach-Object { "0x{0:x2}" -f $_ }) -join ", "
-
-          $content = Get-Content $constantsPath -Raw
-          $content = $content -replace 'byte\[\] data = \[\]; // \[PLACEHOLDER_DATA\]', "byte[] data = [$dataStr];"
-          $content = $content -replace 'byte\[\] key = \[\];  // \[PLACEHOLDER_KEY\]', "byte[] key = [$keyStr];"
-          Set-Content $constantsPath $content
+          ./.github/scripts/inject-token.ps1 -Token "${{ secrets.UPLOADTHING_TOKEN }}"
 
       - name: Publish Windows App
         shell: pwsh
@@ -138,26 +119,7 @@ jobs:
       - name: Inject Secrets
         shell: pwsh
         run: |
-          $constantsPath = "GenHub/GenHub.Core/Constants/ApiConstants.cs"
-          $token = "${{ secrets.UPLOADTHING_TOKEN }}"
-          if ([string]::IsNullOrEmpty($token)) { throw "UPLOADTHING_TOKEN secret is not set in GitHub Settings" }
-
-          $tokenBytes = [System.Text.Encoding]::UTF8.GetBytes($token)
-          $key = New-Object byte[] 32
-          [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($key)
-
-          $obfuscated = New-Object byte[] $tokenBytes.Length
-          for ($i = 0; $i -lt $tokenBytes.Length; $i++) {
-              $obfuscated[$i] = $tokenBytes[$i] -bxor $key[$i % $key.Length]
-          }
-
-          $dataStr = ($obfuscated | ForEach-Object { "0x{0:x2}" -f $_ }) -join ", "
-          $keyStr = ($key | ForEach-Object { "0x{0:x2}" -f $_ }) -join ", "
-
-          $content = Get-Content $constantsPath -Raw
-          $content = $content -replace 'byte\[\] data = \[\]; // \[PLACEHOLDER_DATA\]', "byte[] data = [$dataStr];"
-          $content = $content -replace 'byte\[\] key = \[\];  // \[PLACEHOLDER_KEY\]', "byte[] key = [$keyStr];"
-          Set-Content $constantsPath $content
+          ./.github/scripts/inject-token.ps1 -Token "${{ secrets.UPLOADTHING_TOKEN }}"
 
       - name: Publish Linux App
         run: |