From b72f5887ffc86fa51940b2c0d249e6ea803b7ca5 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 11:14:58 -0700
Subject: [PATCH 01/19] trigger workflow

---
 .github/workflows/runway_ios_rc_workflow.yml | 138 +++++++++++++++++++
 1 file changed, 138 insertions(+)
 create mode 100644 .github/workflows/runway_ios_rc_workflow.yml

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
new file mode 100644
index 000000000000..621f4b4ab441
--- /dev/null
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -0,0 +1,138 @@
+##############################################################################################
+#
+# Runway iOS RC Workflow
+#
+# Triggered from Runway to either:
+# - Push an OTA update (when OTA_VERSION in app/constants/ota.ts line 9 is bumped), or
+# - Build the mobile app (when there is no OTA version bump).
+#
+# When triggering workflow_dispatch, select the release branch (e.g. release/7.71.0).
+#
+##############################################################################################
+name: Runway iOS RC
+
+on:
+  push:
+    branches:
+      - 'release/*'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Optional git ref (branch) to run against. Defaults to the branch selected in the UI.'
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  pull-requests: read
+  actions: write
+
+jobs:
+  decide:
+    name: Check OTA version and resolve inputs
+    runs-on: ubuntu-latest
+    outputs:
+      ota_bump: ${{ steps.decide.outputs.ota_bump }}
+      base_ref: ${{ steps.decide.outputs.base_ref }}
+      ota_version: ${{ steps.decide.outputs.ota_version }}
+      pr_number: ${{ steps.resolve-pr.outputs.pr_number }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Resolve PR number for current branch
+        id: resolve-pr
+        run: |
+          BRANCH="${{ inputs.ref || github.ref_name }}"
+          # Strip refs/heads/ if present
+          BRANCH="${BRANCH#refs/heads/}"
+          PR_NUMBER=$(gh pr list --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+          echo "Branch: $BRANCH, PR number: ${PR_NUMBER:-none}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Decide OTA vs build
+        id: decide
+        run: |
+          set -e
+          # Version from package.json (e.g. 7.71.0)
+          VERSION=$(node -p "require('./package.json').version")
+          BASE_REF="v${VERSION}"
+          echo "base_ref=${BASE_REF}" >> "$GITHUB_OUTPUT"
+
+          # Extract OTA_VERSION from line 9 (format: export const OTA_VERSION: string = 'vX.Y.Z';)
+          extract_ota() { sed -n '9p' "$1" | sed "s/.*'\\([^']*\\)'.*/\1/"; }
+
+          # OTA_VERSION from current ref
+          CURRENT_OTA=$(extract_ota app/constants/ota.ts)
+          echo "ota_version=${CURRENT_OTA}" >> "$GITHUB_OUTPUT"
+
+          # OTA_VERSION at base ref (release tag); if tag missing, treat as no bump
+          if git rev-parse "$BASE_REF" >/dev/null 2>&1; then
+            BASE_OTA=$(git show "${BASE_REF}:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
+            if [[ -n "$BASE_OTA" && "$CURRENT_OTA" != "$BASE_OTA" ]]; then
+              echo "ota_bump=true" >> "$GITHUB_OUTPUT"
+              echo "OTA_VERSION changed: $BASE_OTA -> $CURRENT_OTA → will trigger OTA update"
+            else
+              echo "ota_bump=false" >> "$GITHUB_OUTPUT"
+              echo "No OTA version bump (base: $BASE_OTA, current: $CURRENT_OTA) → will trigger build"
+            fi
+          else
+            echo "ota_bump=false" >> "$GITHUB_OUTPUT"
+            echo "Base ref ${BASE_REF} not found → will trigger build"
+          fi
+
+  trigger-ota:
+    name: Trigger OTA update
+    needs: decide
+    if: needs.decide.outputs.ota_bump == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR number
+        run: |
+          if [[ -z "${{ needs.decide.outputs.pr_number }}" ]]; then
+            echo "::error::No PR found for this branch. OTA update requires a PR number."
+            exit 1
+          fi
+          echo "Using PR #${{ needs.decide.outputs.pr_number }}"
+
+      - name: Trigger Push OTA Update workflow
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const ref = '${{ inputs.ref || github.ref_name }}'.replace(/^refs\/heads\//, '');
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'push-eas-update.yml',
+              ref: ref,
+              inputs: {
+                pr_number: '${{ needs.decide.outputs.pr_number }}',
+                base_branch: '${{ needs.decide.outputs.base_ref }}',
+                message: '${{ needs.decide.outputs.ota_version }}',
+                channel: 'rc',
+                platform: 'ios'
+              }
+            });
+            core.notice(`Triggered Push OTA Update on ${ref} (PR #${{ needs.decide.outputs.pr_number }}, base: ${{ needs.decide.outputs.base_ref }}, message: ${{ needs.decide.outputs.ota_version }})`);
+
+  trigger-build:
+    name: Trigger build mobile app
+    needs: decide
+    if: needs.decide.outputs.ota_bump != 'true'
+    uses: ./.github/workflows/build.yml
+    with:
+      build_name: main-rc
+      platform: ios
+      skip_version_bump: false
+    secrets: inherit

From 4094ec08d734627200217a0d857cd39ce43ae036 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 11:16:08 -0700
Subject: [PATCH 02/19] fix permission issue

---
 .github/workflows/runway_ios_rc_workflow.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index 621f4b4ab441..cb5783ae18b5 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -23,9 +23,10 @@ on:
         type: string
 
 permissions:
-  contents: read
+  contents: write   # required by build.yml (update-build-version job)
   pull-requests: read
   actions: write
+  id-token: write  # required by build.yml
 
 jobs:
   decide:

From 8e6eb3030f0c7737f3daba8e2b7a9718103c8fc6 Mon Sep 17 00:00:00 2001
From: metamaskbot <metamaskbot@users.noreply.github.com>
Date: Wed, 18 Mar 2026 18:19:25 +0000
Subject: [PATCH 03/19] [skip ci] Bump version number to 4061

---
 android/app/build.gradle               |  2 +-
 bitrise.yml                            |  4 ++--
 ios/MetaMask.xcodeproj/project.pbxproj | 12 ++++++------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/android/app/build.gradle b/android/app/build.gradle
index 97165e049447..a91a34f31f06 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -188,7 +188,7 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionName "7.71.0"
-        versionCode 3607
+        versionCode 4061
         testBuildType System.getProperty('testBuildType', 'debug')
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         manifestPlaceholders.MM_BRANCH_KEY_TEST = "$System.env.MM_BRANCH_KEY_TEST"
diff --git a/bitrise.yml b/bitrise.yml
index c8f848cf5bda..264a731a9bdb 100644
--- a/bitrise.yml
+++ b/bitrise.yml
@@ -3534,13 +3534,13 @@ app:
       VERSION_NAME: 7.71.0
     - opts:
         is_expand: false
-      VERSION_NUMBER: 3911
+      VERSION_NUMBER: 4061
     - opts:
         is_expand: false
       FLASK_VERSION_NAME: 7.71.0
     - opts:
         is_expand: false
-      FLASK_VERSION_NUMBER: 3911
+      FLASK_VERSION_NUMBER: 4061
     - opts:
         is_expand: false
       ANDROID_APK_LINK: ''
diff --git a/ios/MetaMask.xcodeproj/project.pbxproj b/ios/MetaMask.xcodeproj/project.pbxproj
index 6726013ffa4b..c8532fdcfd8f 100644
--- a/ios/MetaMask.xcodeproj/project.pbxproj
+++ b/ios/MetaMask.xcodeproj/project.pbxproj
@@ -1281,7 +1281,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 3911;
+				CURRENT_PROJECT_VERSION = 4061;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1350,7 +1350,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 3911;
+				CURRENT_PROJECT_VERSION = 4061;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;
@@ -1416,7 +1416,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 3911;
+				CURRENT_PROJECT_VERSION = 4061;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1483,7 +1483,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 3911;
+				CURRENT_PROJECT_VERSION = 4061;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;
@@ -1646,7 +1646,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 3911;
+				CURRENT_PROJECT_VERSION = 4061;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1716,7 +1716,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 3911;
+				CURRENT_PROJECT_VERSION = 4061;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;

From 805970378ffbf0301cb76bf11c91d2ca662f7845 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 13:30:36 -0700
Subject: [PATCH 04/19] test ota update

---
 app/constants/ota.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/constants/ota.ts b/app/constants/ota.ts
index 70e0dd691f3b..ec21ae8bdf2e 100644
--- a/app/constants/ota.ts
+++ b/app/constants/ota.ts
@@ -6,7 +6,7 @@ import otaConfig from '../../ota.config.js';
  * Reset to v0 when releasing a new native build
  * We keep this OTA_VERSION here to because changes in ota.config.js will affect the fingerprint and break the workflow in Github Actions
  */
-export const OTA_VERSION: string = 'v7.65.1';
+export const OTA_VERSION: string = 'v7.70.1';
 export const RUNTIME_VERSION = otaConfig.RUNTIME_VERSION;
 export const PROJECT_ID = otaConfig.PROJECT_ID;
 export const UPDATE_URL = otaConfig.UPDATE_URL;

From 7d64236e08d8d832851cea6b1c62414c2ab5350c Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 13:37:36 -0700
Subject: [PATCH 05/19] resolve if release tag does not exist

---
 .github/workflows/runway_ios_rc_workflow.yml | 28 +++++++++++---------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index cb5783ae18b5..5d53859293e1 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -67,8 +67,7 @@ jobs:
           set -e
           # Version from package.json (e.g. 7.71.0)
           VERSION=$(node -p "require('./package.json').version")
-          BASE_REF="v${VERSION}"
-          echo "base_ref=${BASE_REF}" >> "$GITHUB_OUTPUT"
+          RELEASE_TAG="v${VERSION}"
 
           # Extract OTA_VERSION from line 9 (format: export const OTA_VERSION: string = 'vX.Y.Z';)
           extract_ota() { sed -n '9p' "$1" | sed "s/.*'\\([^']*\\)'.*/\1/"; }
@@ -77,19 +76,24 @@ jobs:
           CURRENT_OTA=$(extract_ota app/constants/ota.ts)
           echo "ota_version=${CURRENT_OTA}" >> "$GITHUB_OUTPUT"
 
-          # OTA_VERSION at base ref (release tag); if tag missing, treat as no bump
-          if git rev-parse "$BASE_REF" >/dev/null 2>&1; then
+          # Resolve base ref for comparison and for OTA workflow (fingerprint comparison)
+          # Prefer release tag; when tag does not exist (e.g. release branch before tag is cut), use main
+          if git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then
+            BASE_REF="$RELEASE_TAG"
             BASE_OTA=$(git show "${BASE_REF}:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
-            if [[ -n "$BASE_OTA" && "$CURRENT_OTA" != "$BASE_OTA" ]]; then
-              echo "ota_bump=true" >> "$GITHUB_OUTPUT"
-              echo "OTA_VERSION changed: $BASE_OTA -> $CURRENT_OTA → will trigger OTA update"
-            else
-              echo "ota_bump=false" >> "$GITHUB_OUTPUT"
-              echo "No OTA version bump (base: $BASE_OTA, current: $CURRENT_OTA) → will trigger build"
-            fi
+          else
+            BASE_REF="main"
+            BASE_OTA=$(git show "origin/main:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
+            echo "Release tag ${RELEASE_TAG} not found; comparing OTA_VERSION to ${BASE_REF}"
+          fi
+          echo "base_ref=${BASE_REF}" >> "$GITHUB_OUTPUT"
+
+          if [[ -n "$BASE_OTA" && "$CURRENT_OTA" != "$BASE_OTA" ]]; then
+            echo "ota_bump=true" >> "$GITHUB_OUTPUT"
+            echo "OTA_VERSION changed: $BASE_OTA -> $CURRENT_OTA → will trigger OTA update"
           else
             echo "ota_bump=false" >> "$GITHUB_OUTPUT"
-            echo "Base ref ${BASE_REF} not found → will trigger build"
+            echo "No OTA version bump (base: $BASE_OTA, current: $CURRENT_OTA) → will trigger build"
           fi
 
   trigger-ota:

From 552f6b04533b5bad2af239460ef080e8d692ea71 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 13:51:45 -0700
Subject: [PATCH 06/19] fix no PR number found error

---
 .github/workflows/runway_ios_rc_workflow.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index 5d53859293e1..e58e432185c0 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -55,7 +55,14 @@ jobs:
           BRANCH="${{ inputs.ref || github.ref_name }}"
           # Strip refs/heads/ if present
           BRANCH="${BRANCH#refs/heads/}"
-          PR_NUMBER=$(gh pr list --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          echo "Resolving PR for branch: $BRANCH (repo: $GITHUB_REPOSITORY)"
+
+          # Try same-repo head first, then owner:branch (required by API when listing pulls)
+          PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          if [[ -z "$PR_NUMBER" ]]; then
+            PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$GITHUB_REPOSITORY_OWNER:$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          fi
+
           echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
           echo "Branch: $BRANCH, PR number: ${PR_NUMBER:-none}"
         env:
@@ -106,6 +113,7 @@ jobs:
         run: |
           if [[ -z "${{ needs.decide.outputs.pr_number }}" ]]; then
             echo "::error::No PR found for this branch. OTA update requires a PR number."
+            echo "::error::If you ran the workflow manually (workflow_dispatch), select your release branch in the 'Use workflow from' dropdown (e.g. release/test-runway-rc-ios-workflow), not main."
             exit 1
           fi
           echo "Using PR #${{ needs.decide.outputs.pr_number }}"

From 76e0a6f7a7bd4424fc53942fea9902e894f06b4c Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 13:57:27 -0700
Subject: [PATCH 07/19] fix base branch issue

---
 .github/workflows/runway_ios_rc_workflow.yml | 19 +++++++++----------
 app/constants/ota.ts                         |  2 +-
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index e58e432185c0..91ce22a60a24 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -23,10 +23,10 @@ on:
         type: string
 
 permissions:
-  contents: write   # required by build.yml (update-build-version job)
+  contents: write # required by build.yml (update-build-version job)
   pull-requests: read
   actions: write
-  id-token: write  # required by build.yml
+  id-token: write # required by build.yml
 
 jobs:
   decide:
@@ -72,9 +72,10 @@ jobs:
         id: decide
         run: |
           set -e
-          # Version from package.json (e.g. 7.71.0)
+          # Version from package.json (e.g. 7.70.0) → base ref for OTA workflow is always v{VERSION}
           VERSION=$(node -p "require('./package.json').version")
           RELEASE_TAG="v${VERSION}"
+          echo "base_ref=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
 
           # Extract OTA_VERSION from line 9 (format: export const OTA_VERSION: string = 'vX.Y.Z';)
           extract_ota() { sed -n '9p' "$1" | sed "s/.*'\\([^']*\\)'.*/\1/"; }
@@ -83,17 +84,15 @@ jobs:
           CURRENT_OTA=$(extract_ota app/constants/ota.ts)
           echo "ota_version=${CURRENT_OTA}" >> "$GITHUB_OUTPUT"
 
-          # Resolve base ref for comparison and for OTA workflow (fingerprint comparison)
-          # Prefer release tag; when tag does not exist (e.g. release branch before tag is cut), use main
+          # Ref to compare against for detecting bump: use release tag if it exists, else main
           if git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then
-            BASE_REF="$RELEASE_TAG"
-            BASE_OTA=$(git show "${BASE_REF}:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
+            COMPARE_REF="$RELEASE_TAG"
+            BASE_OTA=$(git show "${COMPARE_REF}:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
           else
-            BASE_REF="main"
+            COMPARE_REF="main"
             BASE_OTA=$(git show "origin/main:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
-            echo "Release tag ${RELEASE_TAG} not found; comparing OTA_VERSION to ${BASE_REF}"
+            echo "Release tag ${RELEASE_TAG} not found; comparing OTA_VERSION to ${COMPARE_REF} to detect bump"
           fi
-          echo "base_ref=${BASE_REF}" >> "$GITHUB_OUTPUT"
 
           if [[ -n "$BASE_OTA" && "$CURRENT_OTA" != "$BASE_OTA" ]]; then
             echo "ota_bump=true" >> "$GITHUB_OUTPUT"
diff --git a/app/constants/ota.ts b/app/constants/ota.ts
index ec21ae8bdf2e..0a314dca1ba6 100644
--- a/app/constants/ota.ts
+++ b/app/constants/ota.ts
@@ -6,7 +6,7 @@ import otaConfig from '../../ota.config.js';
  * Reset to v0 when releasing a new native build
  * We keep this OTA_VERSION here to because changes in ota.config.js will affect the fingerprint and break the workflow in Github Actions
  */
-export const OTA_VERSION: string = 'v7.70.1';
+export const OTA_VERSION: string = 'v7.71.1';
 export const RUNTIME_VERSION = otaConfig.RUNTIME_VERSION;
 export const PROJECT_ID = otaConfig.PROJECT_ID;
 export const UPDATE_URL = otaConfig.UPDATE_URL;

From 93bd6ad1fb9c306734713d5df1620a33e5d6ad26 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 14:10:59 -0700
Subject: [PATCH 08/19] change version to 7.69.0

---
 android/app/build.gradle               |  2 +-
 app/constants/ota.ts                   |  2 +-
 bitrise.yml                            |  4 ++--
 ios/MetaMask.xcodeproj/project.pbxproj | 12 ++++++------
 package.json                           |  2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/android/app/build.gradle b/android/app/build.gradle
index a91a34f31f06..e803d1d30c69 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -187,7 +187,7 @@ android {
         applicationId "io.metamask"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionName "7.71.0"
+        versionName "7.69.0"
         versionCode 4061
         testBuildType System.getProperty('testBuildType', 'debug')
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
diff --git a/app/constants/ota.ts b/app/constants/ota.ts
index 0a314dca1ba6..a86abec75316 100644
--- a/app/constants/ota.ts
+++ b/app/constants/ota.ts
@@ -6,7 +6,7 @@ import otaConfig from '../../ota.config.js';
  * Reset to v0 when releasing a new native build
  * We keep this OTA_VERSION here to because changes in ota.config.js will affect the fingerprint and break the workflow in Github Actions
  */
-export const OTA_VERSION: string = 'v7.71.1';
+export const OTA_VERSION: string = 'v7.69.3';
 export const RUNTIME_VERSION = otaConfig.RUNTIME_VERSION;
 export const PROJECT_ID = otaConfig.PROJECT_ID;
 export const UPDATE_URL = otaConfig.UPDATE_URL;
diff --git a/bitrise.yml b/bitrise.yml
index 264a731a9bdb..2d46a1ef1836 100644
--- a/bitrise.yml
+++ b/bitrise.yml
@@ -3531,13 +3531,13 @@ app:
       PROJECT_LOCATION_IOS: ios
     - opts:
         is_expand: false
-      VERSION_NAME: 7.71.0
+      VERSION_NAME: 7.69.0
     - opts:
         is_expand: false
       VERSION_NUMBER: 4061
     - opts:
         is_expand: false
-      FLASK_VERSION_NAME: 7.71.0
+      FLASK_VERSION_NAME: 7.69.0
     - opts:
         is_expand: false
       FLASK_VERSION_NUMBER: 4061
diff --git a/ios/MetaMask.xcodeproj/project.pbxproj b/ios/MetaMask.xcodeproj/project.pbxproj
index c8532fdcfd8f..252bcf377bb8 100644
--- a/ios/MetaMask.xcodeproj/project.pbxproj
+++ b/ios/MetaMask.xcodeproj/project.pbxproj
@@ -1319,7 +1319,7 @@
 					"${inherited}",
 				);
 				LLVM_LTO = YES;
-				MARKETING_VERSION = 7.71.0;
+				MARKETING_VERSION = 7.69.0;
 				ONLY_ACTIVE_ARCH = YES;
 				OTHER_CFLAGS = "$(inherited)";
 				OTHER_LDFLAGS = (
@@ -1385,7 +1385,7 @@
 					"${inherited}",
 				);
 				LLVM_LTO = YES;
-				MARKETING_VERSION = 7.71.0;
+				MARKETING_VERSION = 7.69.0;
 				ONLY_ACTIVE_ARCH = NO;
 				OTHER_CFLAGS = "$(inherited)";
 				OTHER_LDFLAGS = (
@@ -1454,7 +1454,7 @@
 					"\"$(SRCROOT)/MetaMask/System/Library/Frameworks\"",
 				);
 				LLVM_LTO = YES;
-				MARKETING_VERSION = 7.71.0;
+				MARKETING_VERSION = 7.69.0;
 				ONLY_ACTIVE_ARCH = YES;
 				OTHER_CFLAGS = "$(inherited)";
 				OTHER_LDFLAGS = (
@@ -1518,7 +1518,7 @@
 					"\"$(SRCROOT)/MetaMask/System/Library/Frameworks\"",
 				);
 				LLVM_LTO = YES;
-				MARKETING_VERSION = 7.71.0;
+				MARKETING_VERSION = 7.69.0;
 				ONLY_ACTIVE_ARCH = NO;
 				OTHER_CFLAGS = "$(inherited)";
 				OTHER_LDFLAGS = (
@@ -1684,7 +1684,7 @@
 					"\"$(SRCROOT)/MetaMask/System/Library/Frameworks\"",
 				);
 				LLVM_LTO = YES;
-				MARKETING_VERSION = 7.71.0;
+				MARKETING_VERSION = 7.69.0;
 				ONLY_ACTIVE_ARCH = YES;
 				OTHER_CFLAGS = (
 					"$(inherited)",
@@ -1751,7 +1751,7 @@
 					"\"$(SRCROOT)/MetaMask/System/Library/Frameworks\"",
 				);
 				LLVM_LTO = YES;
-				MARKETING_VERSION = 7.71.0;
+				MARKETING_VERSION = 7.69.0;
 				ONLY_ACTIVE_ARCH = NO;
 				OTHER_CFLAGS = (
 					"$(inherited)",
diff --git a/package.json b/package.json
index 99f297c61451..e7ec3a3e6b82 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "metamask",
-  "version": "7.71.0",
+  "version": "7.69.0",
   "private": true,
   "scripts": {
     "install:foundryup": "yarn mm-foundryup",

From f12eda7188d5e4b28d0d91639c507eaa1972383f Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 11:14:58 -0700
Subject: [PATCH 09/19] trigger workflow

fix permission issue

test ota update

[skip ci] Bump version number to 4061

resolve if release tag does not exist

fix no PR number found error

fix base branch issue

change version to 7.69.0

change to workflow_dispatch

revert build number

change ota version

revert build number
---
 .github/workflows/runway_ios_rc_workflow.yml | 147 +++++++++++++++++++
 app/constants/ota.ts                         |   2 +-
 2 files changed, 148 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/runway_ios_rc_workflow.yml

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
new file mode 100644
index 000000000000..6c1401771d74
--- /dev/null
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -0,0 +1,147 @@
+##############################################################################################
+#
+# Runway iOS RC Workflow
+#
+# Triggered from Runway to either:
+# - Push an OTA update (when OTA_VERSION in app/constants/ota.ts line 9 is bumped), or
+# - Build the mobile app (when there is no OTA version bump).
+#
+# When triggering workflow_dispatch, select the release branch (e.g. release/7.71.0).
+#
+##############################################################################################
+name: Runway iOS RC
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Optional git ref (branch) to run against. Defaults to the branch selected in the UI.'
+        required: false
+        type: string
+
+permissions:
+  contents: write # required by build.yml (update-build-version job)
+  pull-requests: read
+  actions: write
+  id-token: write # required by build.yml
+
+jobs:
+  decide:
+    name: Check OTA version and resolve inputs
+    runs-on: ubuntu-latest
+    outputs:
+      ota_bump: ${{ steps.decide.outputs.ota_bump }}
+      base_ref: ${{ steps.decide.outputs.base_ref }}
+      ota_version: ${{ steps.decide.outputs.ota_version }}
+      pr_number: ${{ steps.resolve-pr.outputs.pr_number }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Resolve PR number for current branch
+        id: resolve-pr
+        run: |
+          BRANCH="${{ inputs.ref || github.ref_name }}"
+          # Strip refs/heads/ if present
+          BRANCH="${BRANCH#refs/heads/}"
+          echo "Resolving PR for branch: $BRANCH (repo: $GITHUB_REPOSITORY)"
+
+          # Try same-repo head first, then owner:branch (required by API when listing pulls)
+          PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          if [[ -z "$PR_NUMBER" ]]; then
+            PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$GITHUB_REPOSITORY_OWNER:$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          fi
+
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+          echo "Branch: $BRANCH, PR number: ${PR_NUMBER:-none}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Decide OTA vs build
+        id: decide
+        run: |
+          set -e
+          # Version from package.json (e.g. 7.70.0) → base ref for OTA workflow is always v{VERSION}
+          VERSION=$(node -p "require('./package.json').version")
+          RELEASE_TAG="v${VERSION}"
+          echo "base_ref=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
+
+          # Extract OTA_VERSION from line 9 (format: export const OTA_VERSION: string = 'vX.Y.Z';)
+          extract_ota() { sed -n '9p' "$1" | sed "s/.*'\\([^']*\\)'.*/\1/"; }
+
+          # OTA_VERSION from current ref
+          CURRENT_OTA=$(extract_ota app/constants/ota.ts)
+          echo "ota_version=${CURRENT_OTA}" >> "$GITHUB_OUTPUT"
+
+          # Ref to compare against for detecting bump: use release tag if it exists, else main
+          if git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then
+            COMPARE_REF="$RELEASE_TAG"
+            BASE_OTA=$(git show "${COMPARE_REF}:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
+          else
+            COMPARE_REF="main"
+            BASE_OTA=$(git show "origin/main:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
+            echo "Release tag ${RELEASE_TAG} not found; comparing OTA_VERSION to ${COMPARE_REF} to detect bump"
+          fi
+
+          if [[ -n "$BASE_OTA" && "$CURRENT_OTA" != "$BASE_OTA" ]]; then
+            echo "ota_bump=true" >> "$GITHUB_OUTPUT"
+            echo "OTA_VERSION changed: $BASE_OTA -> $CURRENT_OTA → will trigger OTA update"
+          else
+            echo "ota_bump=false" >> "$GITHUB_OUTPUT"
+            echo "No OTA version bump (base: $BASE_OTA, current: $CURRENT_OTA) → will trigger build"
+          fi
+
+  trigger-ota:
+    name: Trigger OTA update
+    needs: decide
+    if: needs.decide.outputs.ota_bump == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR number
+        run: |
+          if [[ -z "${{ needs.decide.outputs.pr_number }}" ]]; then
+            echo "::error::No PR found for this branch. OTA update requires a PR number."
+            echo "::error::If you ran the workflow manually (workflow_dispatch), select your release branch in the 'Use workflow from' dropdown (e.g. release/test-runway-rc-ios-workflow), not main."
+            exit 1
+          fi
+          echo "Using PR #${{ needs.decide.outputs.pr_number }}"
+
+      - name: Trigger Push OTA Update workflow
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const ref = '${{ inputs.ref || github.ref_name }}'.replace(/^refs\/heads\//, '');
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'push-eas-update.yml',
+              ref: ref,
+              inputs: {
+                pr_number: '${{ needs.decide.outputs.pr_number }}',
+                base_branch: '${{ needs.decide.outputs.base_ref }}',
+                message: '${{ needs.decide.outputs.ota_version }}',
+                channel: 'rc',
+                platform: 'ios'
+              }
+            });
+            core.notice(`Triggered Push OTA Update on ${ref} (PR #${{ needs.decide.outputs.pr_number }}, base: ${{ needs.decide.outputs.base_ref }}, message: ${{ needs.decide.outputs.ota_version }})`);
+
+  trigger-build:
+    name: Trigger build mobile app
+    needs: decide
+    if: needs.decide.outputs.ota_bump != 'true'
+    uses: ./.github/workflows/build.yml
+    with:
+      build_name: main-rc
+      platform: ios
+      skip_version_bump: false
+    secrets: inherit
diff --git a/app/constants/ota.ts b/app/constants/ota.ts
index 70e0dd691f3b..dcee9f030dda 100644
--- a/app/constants/ota.ts
+++ b/app/constants/ota.ts
@@ -6,7 +6,7 @@ import otaConfig from '../../ota.config.js';
  * Reset to v0 when releasing a new native build
  * We keep this OTA_VERSION here to because changes in ota.config.js will affect the fingerprint and break the workflow in Github Actions
  */
-export const OTA_VERSION: string = 'v7.65.1';
+export const OTA_VERSION: string = 'vX.XX.X';
 export const RUNTIME_VERSION = otaConfig.RUNTIME_VERSION;
 export const PROJECT_ID = otaConfig.PROJECT_ID;
 export const UPDATE_URL = otaConfig.UPDATE_URL;

From e6bbbc936cc702859c874e2ed3b1108a5a8dfdb5 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Wed, 18 Mar 2026 15:55:29 -0700
Subject: [PATCH 10/19] fix(ci): pass ref to build.yml so RC build uses same
 branch as OTA check

---
 .github/workflows/build.yml                  | 4 ++--
 .github/workflows/runway_ios_rc_workflow.yml | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 66495dbea6d5..74fe1aaf3583 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,7 +14,7 @@ on:
         type: boolean
         default: false
       ref:
-        description: 'Git ref to checkout when skip_version_bump is true. Defaults to the triggering event ref.'
+        description: 'Git ref (branch) to run the build against. Used as base-branch for version bump and for checkout when skip_version_bump is true. Defaults to the triggering event ref.'
         required: false
         type: string
         default: ''
@@ -60,7 +60,7 @@ jobs:
       contents: write
       id-token: write
     with:
-      base-branch: ${{ github.ref_name }}
+      base-branch: ${{ inputs.ref || github.ref_name }}
     secrets:
       PR_TOKEN: ${{ secrets.PR_TOKEN }}
 
diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index 6c1401771d74..c6de1ac8856b 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -144,4 +144,5 @@ jobs:
       build_name: main-rc
       platform: ios
       skip_version_bump: false
+      ref: ${{ inputs.ref || github.ref_name }}
     secrets: inherit

From 9873c5d59d9c49c442f22a53dcea6f0ab26cb6b8 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Thu, 19 Mar 2026 09:49:53 -0700
Subject: [PATCH 11/19] add runway_android_rc_workflow.yml

---
 .../workflows/runway_android_rc_workflow.yml  | 148 ++++++++++++++++++
 .github/workflows/runway_ios_rc_workflow.yml  |   2 +-
 2 files changed, 149 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/runway_android_rc_workflow.yml

diff --git a/.github/workflows/runway_android_rc_workflow.yml b/.github/workflows/runway_android_rc_workflow.yml
new file mode 100644
index 000000000000..20e842a01a1b
--- /dev/null
+++ b/.github/workflows/runway_android_rc_workflow.yml
@@ -0,0 +1,148 @@
+##############################################################################################
+#
+# Runway Android RC Workflow
+#
+# Triggered from Runway to either:
+# - Push an OTA update (when OTA_VERSION in app/constants/ota.ts line 9 is bumped), or
+# - Build the mobile app (when there is no OTA version bump).
+#
+# When triggering workflow_dispatch, select the release branch (e.g. release/7.71.0).
+#
+##############################################################################################
+name: Runway Android RC
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Optional git ref (branch) to run against. Defaults to the branch selected in the UI.'
+        required: false
+        type: string
+
+permissions:
+  contents: write # required by build.yml (update-build-version job)
+  pull-requests: read
+  actions: write
+  id-token: write # required by build.yml
+
+jobs:
+  decide:
+    name: Check OTA version and resolve inputs
+    runs-on: ubuntu-latest
+    outputs:
+      ota_bump: ${{ steps.decide.outputs.ota_bump }}
+      base_ref: ${{ steps.decide.outputs.base_ref }}
+      ota_version: ${{ steps.decide.outputs.ota_version }}
+      pr_number: ${{ steps.resolve-pr.outputs.pr_number }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Resolve PR number for current branch
+        id: resolve-pr
+        run: |
+          BRANCH="${{ inputs.ref || github.ref_name }}"
+          # Strip refs/heads/ if present
+          BRANCH="${BRANCH#refs/heads/}"
+          echo "Resolving PR for branch: $BRANCH (repo: $GITHUB_REPOSITORY)"
+
+          # Try same-repo head first, then owner:branch (required by API when listing pulls)
+          PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          if [[ -z "$PR_NUMBER" ]]; then
+            PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$GITHUB_REPOSITORY_OWNER:$BRANCH" --json number --jq '.[0].number' 2>/dev/null || echo "")
+          fi
+
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+          echo "Branch: $BRANCH, PR number: ${PR_NUMBER:-none}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Decide OTA vs build
+        id: decide
+        run: |
+          set -e
+          # Version from package.json (e.g. 7.70.0) → base ref for OTA workflow is always v{VERSION}
+          VERSION=$(node -p "require('./package.json').version")
+          RELEASE_TAG="v${VERSION}"
+          echo "base_ref=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
+
+          # Extract OTA_VERSION from line 9 (format: export const OTA_VERSION: string = 'vX.Y.Z';)
+          extract_ota() { sed -n '9p' "$1" | sed "s/.*'\\([^']*\\)'.*/\1/"; }
+
+          # OTA_VERSION from current ref
+          CURRENT_OTA=$(extract_ota app/constants/ota.ts)
+          echo "ota_version=${CURRENT_OTA}" >> "$GITHUB_OUTPUT"
+
+          # Ref to compare against for detecting bump: use release tag if it exists, else main
+          if git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then
+            COMPARE_REF="$RELEASE_TAG"
+            BASE_OTA=$(git show "${COMPARE_REF}:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
+          else
+            COMPARE_REF="main"
+            BASE_OTA=$(git show "origin/main:app/constants/ota.ts" 2>/dev/null | sed -n '9p' | sed "s/.*'\\([^']*\\)'.*/\1/" || echo "")
+            echo "Release tag ${RELEASE_TAG} not found; comparing OTA_VERSION to ${COMPARE_REF} to detect bump"
+          fi
+
+          if [[ -n "$BASE_OTA" && "$CURRENT_OTA" != "$BASE_OTA" ]]; then
+            echo "ota_bump=true" >> "$GITHUB_OUTPUT"
+            echo "OTA_VERSION changed: $BASE_OTA -> $CURRENT_OTA → will trigger OTA update"
+          else
+            echo "ota_bump=false" >> "$GITHUB_OUTPUT"
+            echo "No OTA version bump (base: $BASE_OTA, current: $CURRENT_OTA) → will trigger build"
+          fi
+
+  trigger-ota:
+    name: Trigger OTA update
+    needs: decide
+    if: needs.decide.outputs.ota_bump == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR number
+        run: |
+          if [[ -z "${{ needs.decide.outputs.pr_number }}" ]]; then
+            echo "::error::No PR found for this branch. OTA update requires a PR number."
+            echo "::error::If you ran the workflow manually (workflow_dispatch), select your release branch in the 'Use workflow from' dropdown (e.g. release/7.71.0), not main."
+            exit 1
+          fi
+          echo "Using PR #${{ needs.decide.outputs.pr_number }}"
+
+      - name: Trigger Push OTA Update workflow
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const ref = '${{ inputs.ref || github.ref_name }}'.replace(/^refs\/heads\//, '');
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'push-eas-update.yml',
+              ref: ref,
+              inputs: {
+                pr_number: '${{ needs.decide.outputs.pr_number }}',
+                base_branch: '${{ needs.decide.outputs.base_ref }}',
+                message: '${{ needs.decide.outputs.ota_version }}',
+                channel: 'rc',
+                platform: 'android'
+              }
+            });
+            core.notice(`Triggered Push OTA Update on ${ref} (PR #${{ needs.decide.outputs.pr_number }}, base: ${{ needs.decide.outputs.base_ref }}, message: ${{ needs.decide.outputs.ota_version }})`);
+
+  trigger-build:
+    name: Trigger build mobile app
+    needs: decide
+    if: needs.decide.outputs.ota_bump != 'true'
+    uses: ./.github/workflows/build.yml
+    with:
+      build_name: main-rc
+      platform: android
+      skip_version_bump: false
+      ref: ${{ inputs.ref || github.ref_name }}
+    secrets: inherit
diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index c6de1ac8856b..5dfdd06698b8 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -109,7 +109,7 @@ jobs:
         run: |
           if [[ -z "${{ needs.decide.outputs.pr_number }}" ]]; then
             echo "::error::No PR found for this branch. OTA update requires a PR number."
-            echo "::error::If you ran the workflow manually (workflow_dispatch), select your release branch in the 'Use workflow from' dropdown (e.g. release/test-runway-rc-ios-workflow), not main."
+            echo "::error::If you ran the workflow manually (workflow_dispatch), select your release branch in the 'Use workflow from' dropdown (e.g. release/7.71.0), not main."
             exit 1
           fi
           echo "Using PR #${{ needs.decide.outputs.pr_number }}"

From 9298e1c86c70e68ead1236e61ace402c0db19f3f Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Thu, 19 Mar 2026 15:56:26 -0700
Subject: [PATCH 12/19] add upload to TestFlight job

---
 .github/workflows/runway_ios_rc_workflow.yml | 85 +++++++++++++++++++-
 1 file changed, 84 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index 5dfdd06698b8..cbca709d7529 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -4,7 +4,7 @@
 #
 # Triggered from Runway to either:
 # - Push an OTA update (when OTA_VERSION in app/constants/ota.ts line 9 is bumped), or
-# - Build the mobile app (when there is no OTA version bump).
+# - Build the mobile app and upload the IPA to TestFlight (when there is no OTA version bump).
 #
 # When triggering workflow_dispatch, select the release branch (e.g. release/7.71.0).
 #
@@ -146,3 +146,86 @@ jobs:
       skip_version_bump: false
       ref: ${{ inputs.ref || github.ref_name }}
     secrets: inherit
+
+  testflight-upload-summary:
+    name: TestFlight upload summary
+    needs: [trigger-build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.ref || github.ref_name }}
+      - name: Display TestFlight upload summary
+        run: |
+          BUILD_VERSION=$(node -p "require('./package.json').version")
+          {
+            echo "### 📲 TestFlight Upload (Runway iOS RC)"
+            echo ""
+            echo "| Field | Value |"
+            echo "| --- | --- |"
+            echo "| **Ref** | ${{ inputs.ref || github.ref_name }} |"
+            echo "| **Build name** | main-rc |"
+            echo "| **Build version** | ${BUILD_VERSION} |"
+            echo "| **TestFlight group** | MetaMask BETA & Release Candidates |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  upload-ios-testflight:
+    name: Upload iOS to TestFlight
+    needs: [trigger-build, testflight-upload-summary]
+    runs-on: ghcr.io/cirruslabs/macos-runner:sequoia-xl
+    environment: apple
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.ref || github.ref_name }}
+
+      - name: Setup Ruby (iOS)
+        uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb #v1
+        with:
+          ruby-version: '3.2.9'
+          working-directory: ios
+          bundler-cache: true
+
+      - name: Download iOS build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ios-main-rc
+
+      - name: Find IPA path
+        id: ipa
+        run: |
+          IPA=$(find . -name '*.ipa' -type f | head -1)
+          if [ -z "$IPA" ]; then
+            echo "::error::No .ipa file found in artifact"
+            exit 1
+          fi
+          case "$IPA" in /*) ABS="$IPA" ;; *) ABS="$PWD/$IPA" ;; esac
+          echo "path=$ABS" >> "$GITHUB_OUTPUT"
+
+      - name: Setup App Store Connect API Key
+        run: |
+          bash scripts/setup-app-store-connect-api-key.sh \
+            "$APP_STORE_CONNECT_API_KEY_ISSUER_ID" \
+            "$APP_STORE_CONNECT_API_KEY_KEY_ID" \
+            "$APP_STORE_CONNECT_API_KEY_KEY_CONTENT"
+        env:
+          APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
+          APP_STORE_CONNECT_API_KEY_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY_ID }}
+          APP_STORE_CONNECT_API_KEY_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY_CONTENT }}
+
+      - name: Upload to TestFlight
+        run: |
+          bash scripts/upload-to-testflight.sh \
+            "github_actions_main-rc" \
+            "${{ inputs.ref || github.ref_name }}" \
+            "${{ steps.ipa.outputs.path }}" \
+            "MetaMask BETA & Release Candidates"
+
+      - name: Cleanup API Key
+        if: always()
+        run: |
+          rm -f ios/AuthKey.p8
+          echo "🧹 Cleaned up API key file"

From e9e983c098e054a389b60b1efa0940c70752917a Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Thu, 19 Mar 2026 16:14:41 -0700
Subject: [PATCH 13/19] revert ota version

---
 app/constants/ota.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/constants/ota.ts b/app/constants/ota.ts
index 896b83d65e7e..70e0dd691f3b 100644
--- a/app/constants/ota.ts
+++ b/app/constants/ota.ts
@@ -6,7 +6,7 @@ import otaConfig from '../../ota.config.js';
  * Reset to v0 when releasing a new native build
  * We keep this OTA_VERSION here to because changes in ota.config.js will affect the fingerprint and break the workflow in Github Actions
  */
-export const OTA_VERSION: string = 'v7.71.0';
+export const OTA_VERSION: string = 'v7.65.1';
 export const RUNTIME_VERSION = otaConfig.RUNTIME_VERSION;
 export const PROJECT_ID = otaConfig.PROJECT_ID;
 export const UPDATE_URL = otaConfig.UPDATE_URL;

From 8f5c0eb8d1b0be65b8bb961f2cdbd33f03644799 Mon Sep 17 00:00:00 2001
From: metamaskbot <metamaskbot@users.noreply.github.com>
Date: Thu, 19 Mar 2026 23:17:51 +0000
Subject: [PATCH 14/19] [skip ci] Bump version number to 4109

---
 android/app/build.gradle               |  2 +-
 bitrise.yml                            |  4 ++--
 ios/MetaMask.xcodeproj/project.pbxproj | 12 ++++++------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/android/app/build.gradle b/android/app/build.gradle
index a91a34f31f06..07bc6247b119 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -188,7 +188,7 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionName "7.71.0"
-        versionCode 4061
+        versionCode 4109
         testBuildType System.getProperty('testBuildType', 'debug')
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         manifestPlaceholders.MM_BRANCH_KEY_TEST = "$System.env.MM_BRANCH_KEY_TEST"
diff --git a/bitrise.yml b/bitrise.yml
index 264a731a9bdb..bf5d2e558606 100644
--- a/bitrise.yml
+++ b/bitrise.yml
@@ -3534,13 +3534,13 @@ app:
       VERSION_NAME: 7.71.0
     - opts:
         is_expand: false
-      VERSION_NUMBER: 4061
+      VERSION_NUMBER: 4109
     - opts:
         is_expand: false
       FLASK_VERSION_NAME: 7.71.0
     - opts:
         is_expand: false
-      FLASK_VERSION_NUMBER: 4061
+      FLASK_VERSION_NUMBER: 4109
     - opts:
         is_expand: false
       ANDROID_APK_LINK: ''
diff --git a/ios/MetaMask.xcodeproj/project.pbxproj b/ios/MetaMask.xcodeproj/project.pbxproj
index c8532fdcfd8f..93a70847115a 100644
--- a/ios/MetaMask.xcodeproj/project.pbxproj
+++ b/ios/MetaMask.xcodeproj/project.pbxproj
@@ -1281,7 +1281,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4061;
+				CURRENT_PROJECT_VERSION = 4109;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1350,7 +1350,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4061;
+				CURRENT_PROJECT_VERSION = 4109;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;
@@ -1416,7 +1416,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4061;
+				CURRENT_PROJECT_VERSION = 4109;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1483,7 +1483,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4061;
+				CURRENT_PROJECT_VERSION = 4109;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;
@@ -1646,7 +1646,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4061;
+				CURRENT_PROJECT_VERSION = 4109;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1716,7 +1716,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4061;
+				CURRENT_PROJECT_VERSION = 4109;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;

From 549c65a711f436a18da846e6e47b3b71445f8a5e Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Thu, 19 Mar 2026 16:20:44 -0700
Subject: [PATCH 15/19] use inputs.ref for version bump when source_branch is
 unset

---
 .github/workflows/build.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8de05f9056d4..bf59c2526ede 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,7 +14,7 @@ on:
         type: boolean
         default: false
       source_branch:
-        description: 'Branch, tag, or SHA to build'
+        description: 'Branch, tag, or SHA for version bump and prepare checkout. When non-empty, takes precedence over ref.'
         required: false
         type: string
         default: ''
@@ -65,7 +65,7 @@ jobs:
       contents: write
       id-token: write
     with:
-      base-branch: ${{ inputs.source_branch != '' && inputs.source_branch || github.ref_name }}
+      base-branch: ${{ inputs.source_branch != '' && inputs.source_branch || inputs.ref != '' && inputs.ref || github.ref_name }}
     secrets:
       PR_TOKEN: ${{ secrets.PR_TOKEN }}
 
@@ -80,12 +80,12 @@ jobs:
       signing_aws_role: ${{ steps.config.outputs.signing_aws_role }}
       signing_aws_secret: ${{ steps.config.outputs.signing_aws_secret }}
       signing_android_keystore_path: ${{ steps.config.outputs.signing_android_keystore_path }}
-      checkout_ref_for_setup: ${{ !inputs.skip_version_bump && needs.update-build-version.outputs.commit-hash || (inputs.source_branch != '' && inputs.source_branch || github.ref_name) }}
+      checkout_ref_for_setup: ${{ !inputs.skip_version_bump && needs.update-build-version.outputs.commit-hash || (inputs.source_branch != '' && inputs.source_branch || inputs.ref != '' && inputs.ref || github.ref_name) }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ !inputs.skip_version_bump && needs.update-build-version.outputs.commit-hash || (inputs.source_branch != '' && inputs.source_branch || github.ref_name) }}
+          ref: ${{ !inputs.skip_version_bump && needs.update-build-version.outputs.commit-hash || (inputs.source_branch != '' && inputs.source_branch || inputs.ref != '' && inputs.ref || github.ref_name) }}
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:

From 70cc2c549018a877e44db3650984d070781d67dc Mon Sep 17 00:00:00 2001
From: metamaskbot <metamaskbot@users.noreply.github.com>
Date: Thu, 19 Mar 2026 23:24:58 +0000
Subject: [PATCH 16/19] [skip ci] Bump version number to 4110

---
 android/app/build.gradle               |  2 +-
 bitrise.yml                            |  4 ++--
 ios/MetaMask.xcodeproj/project.pbxproj | 12 ++++++------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/android/app/build.gradle b/android/app/build.gradle
index 07bc6247b119..257c592211dd 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -188,7 +188,7 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionName "7.71.0"
-        versionCode 4109
+        versionCode 4110
         testBuildType System.getProperty('testBuildType', 'debug')
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         manifestPlaceholders.MM_BRANCH_KEY_TEST = "$System.env.MM_BRANCH_KEY_TEST"
diff --git a/bitrise.yml b/bitrise.yml
index bf5d2e558606..682b3c9907d9 100644
--- a/bitrise.yml
+++ b/bitrise.yml
@@ -3534,13 +3534,13 @@ app:
       VERSION_NAME: 7.71.0
     - opts:
         is_expand: false
-      VERSION_NUMBER: 4109
+      VERSION_NUMBER: 4110
     - opts:
         is_expand: false
       FLASK_VERSION_NAME: 7.71.0
     - opts:
         is_expand: false
-      FLASK_VERSION_NUMBER: 4109
+      FLASK_VERSION_NUMBER: 4110
     - opts:
         is_expand: false
       ANDROID_APK_LINK: ''
diff --git a/ios/MetaMask.xcodeproj/project.pbxproj b/ios/MetaMask.xcodeproj/project.pbxproj
index 93a70847115a..6f7efa70a890 100644
--- a/ios/MetaMask.xcodeproj/project.pbxproj
+++ b/ios/MetaMask.xcodeproj/project.pbxproj
@@ -1281,7 +1281,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4109;
+				CURRENT_PROJECT_VERSION = 4110;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1350,7 +1350,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4109;
+				CURRENT_PROJECT_VERSION = 4110;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;
@@ -1416,7 +1416,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4109;
+				CURRENT_PROJECT_VERSION = 4110;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1483,7 +1483,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4109;
+				CURRENT_PROJECT_VERSION = 4110;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;
@@ -1646,7 +1646,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4109;
+				CURRENT_PROJECT_VERSION = 4110;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1716,7 +1716,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4109;
+				CURRENT_PROJECT_VERSION = 4110;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;

From 97773fc6561773bac84b6ceb1e62af1028d1ca29 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Fri, 20 Mar 2026 09:21:27 -0700
Subject: [PATCH 17/19] upload to internal TestFlight

---
 .github/workflows/runway_ios_rc_workflow.yml |  6 ++++--
 ios/fastlane/Fastfile                        | 16 +++++++++++-----
 ios/fastlane/README.md                       |  2 +-
 scripts/upload-to-testflight.sh              |  2 ++
 4 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index cbca709d7529..124e203f9211 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -217,12 +217,14 @@ jobs:
           APP_STORE_CONNECT_API_KEY_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY_CONTENT }}
 
       - name: Upload to TestFlight
+        env:
+          # Runway / GH apple env uses a restricted key; Bitrise keeps default external distribution.
+          TESTFLIGHT_DISTRIBUTE_EXTERNAL: 'false'
         run: |
           bash scripts/upload-to-testflight.sh \
             "github_actions_main-rc" \
             "${{ inputs.ref || github.ref_name }}" \
-            "${{ steps.ipa.outputs.path }}" \
-            "MetaMask BETA & Release Candidates"
+            "${{ steps.ipa.outputs.path }}"
 
       - name: Cleanup API Key
         if: always()
diff --git a/ios/fastlane/Fastfile b/ios/fastlane/Fastfile
index 0e68753d26d0..8bc69afd6dd1 100644
--- a/ios/fastlane/Fastfile
+++ b/ios/fastlane/Fastfile
@@ -20,7 +20,12 @@ platform :ios do
     # Convert groups parameter to array (Fastlane CLI passes strings, not arrays)
     groups_param = options[:groups] || ['MetaMask BETA & Release Candidates']
     groups = groups_param.is_a?(Array) ? groups_param : [groups_param]
-    notify_external_testers = true
+    # Default: distribute to external TestFlight groups (matches historical Fastlane / Bitrise behavior).
+    # Set TESTFLIGHT_DISTRIBUTE_EXTERNAL=false (or 0/no/off) when the API key cannot manage beta groups
+    # (upload still succeeds for internal TestFlight; external step would return "forbidden for security reasons").
+    tf_ext = ENV.fetch('TESTFLIGHT_DISTRIBUTE_EXTERNAL', 'true').to_s.strip.downcase
+    distribute_external = !%w[false 0 no off].include?(tf_ext)
+    notify_external_testers = distribute_external
     
     if ipa_path.nil? || ipa_path.empty?
       UI.user_error!("You must provide an ipa_path using ipa_path: '/path/to/app.ipa'")
@@ -93,14 +98,15 @@ platform :ios do
     )
     
     # Upload to TestFlight with API key from app_store_connect_api_key action
-    upload_to_testflight(
+    upload_params = {
       api_key: api_key,
       ipa: ipa_path,
-      distribute_external: true,
-      groups: groups,
+      distribute_external: distribute_external,
       notify_external_testers: notify_external_testers,
       changelog: changelog_message
-    )
+    }
+    upload_params[:groups] = groups if distribute_external
+    upload_to_testflight(**upload_params)
   end
 end
 
diff --git a/ios/fastlane/README.md b/ios/fastlane/README.md
index 889574b8cd02..ceac8873c85b 100644
--- a/ios/fastlane/README.md
+++ b/ios/fastlane/README.md
@@ -4,7 +4,7 @@ This Fastlane configuration handles uploading iOS builds to TestFlight via Bitri
 
 ## Overview
 
-The `upload_to_testflight_only` lane uploads pre-built IPA files to TestFlight and distributes them to external testing groups.
+The `upload_to_testflight_only` lane uploads pre-built IPA files to TestFlight and, by default, distributes them to external testing groups (same as historical Bitrise behavior). Set `TESTFLIGHT_DISTRIBUTE_EXTERNAL=false` (or `0`, `no`, `off`) for upload-only when the App Store Connect API key cannot manage external beta groups.
 
 ## GitHub Actions
 
diff --git a/scripts/upload-to-testflight.sh b/scripts/upload-to-testflight.sh
index f67e358c0548..a4826b951467 100644
--- a/scripts/upload-to-testflight.sh
+++ b/scripts/upload-to-testflight.sh
@@ -14,6 +14,8 @@
 #
 # Environment variables:
 #   IPA_PATH - IPA path (set by find-ipa-file.sh if not provided as argument)
+#   TESTFLIGHT_DISTRIBUTE_EXTERNAL - Default "true": distribute to external TestFlight groups after upload.
+#     Set to "false" (or 0/no/off) for upload-only when the API key lacks App Manager access to beta groups.
 
 set -e
 

From 9deb8470f11be2009e748acdf279adf620e731e1 Mon Sep 17 00:00:00 2001
From: Wei Sun <wei.sun@consensys.net>
Date: Fri, 20 Mar 2026 10:03:31 -0700
Subject: [PATCH 18/19] upload to internal group only

---
 .github/workflows/runway_ios_rc_workflow.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/runway_ios_rc_workflow.yml b/.github/workflows/runway_ios_rc_workflow.yml
index cbca709d7529..281a4cd37564 100644
--- a/.github/workflows/runway_ios_rc_workflow.yml
+++ b/.github/workflows/runway_ios_rc_workflow.yml
@@ -222,7 +222,8 @@ jobs:
             "github_actions_main-rc" \
             "${{ inputs.ref || github.ref_name }}" \
             "${{ steps.ipa.outputs.path }}" \
-            "MetaMask BETA & Release Candidates"
+            "" \
+            "false"
 
       - name: Cleanup API Key
         if: always()

From a63ef540333d5caf1c17b9c2dac43fc191f5c7c2 Mon Sep 17 00:00:00 2001
From: metamaskbot <metamaskbot@users.noreply.github.com>
Date: Fri, 20 Mar 2026 17:25:00 +0000
Subject: [PATCH 19/19] [skip ci] Bump version number to 4127

---
 android/app/build.gradle               |  2 +-
 bitrise.yml                            |  4 ++--
 ios/MetaMask.xcodeproj/project.pbxproj | 12 ++++++------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/android/app/build.gradle b/android/app/build.gradle
index 257c592211dd..d556b01225ca 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -188,7 +188,7 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionName "7.71.0"
-        versionCode 4110
+        versionCode 4127
         testBuildType System.getProperty('testBuildType', 'debug')
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         manifestPlaceholders.MM_BRANCH_KEY_TEST = "$System.env.MM_BRANCH_KEY_TEST"
diff --git a/bitrise.yml b/bitrise.yml
index 682b3c9907d9..034f86ef8e6c 100644
--- a/bitrise.yml
+++ b/bitrise.yml
@@ -3534,13 +3534,13 @@ app:
       VERSION_NAME: 7.71.0
     - opts:
         is_expand: false
-      VERSION_NUMBER: 4110
+      VERSION_NUMBER: 4127
     - opts:
         is_expand: false
       FLASK_VERSION_NAME: 7.71.0
     - opts:
         is_expand: false
-      FLASK_VERSION_NUMBER: 4110
+      FLASK_VERSION_NUMBER: 4127
     - opts:
         is_expand: false
       ANDROID_APK_LINK: ''
diff --git a/ios/MetaMask.xcodeproj/project.pbxproj b/ios/MetaMask.xcodeproj/project.pbxproj
index 6f7efa70a890..e3079cb5db1a 100644
--- a/ios/MetaMask.xcodeproj/project.pbxproj
+++ b/ios/MetaMask.xcodeproj/project.pbxproj
@@ -1281,7 +1281,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4110;
+				CURRENT_PROJECT_VERSION = 4127;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1350,7 +1350,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4110;
+				CURRENT_PROJECT_VERSION = 4127;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;
@@ -1416,7 +1416,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4110;
+				CURRENT_PROJECT_VERSION = 4127;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1483,7 +1483,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4110;
+				CURRENT_PROJECT_VERSION = 4127;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;
@@ -1646,7 +1646,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4110;
+				CURRENT_PROJECT_VERSION = 4127;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				DEVELOPMENT_TEAM = 48XVW22RCG;
@@ -1716,7 +1716,7 @@
 				CODE_SIGN_ENTITLEMENTS = MetaMask/MetaMask.entitlements;
 				CODE_SIGN_IDENTITY = "iPhone Distribution";
 				CODE_SIGN_STYLE = Manual;
-				CURRENT_PROJECT_VERSION = 4110;
+				CURRENT_PROJECT_VERSION = 4127;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				DEVELOPMENT_TEAM = 48XVW22RCG;
 				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = 48XVW22RCG;