diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f673faa..6474f3e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,8 +23,18 @@ jobs:
     env:
       WRAITH_REQUIRE_PTRACE: "1"
       CARGO_TERM_COLOR: always
+      # package_deb.sh otherwise derives maintainer identity from the HEAD commit
+      # author; dependabot[bot] fails its e-mail validation. Configure repo variable DEBEMAIL.
+      DEBFULLNAME: ${{ vars.DEBFULLNAME || 'grloper' }}
+      DEBEMAIL: ${{ vars.DEBEMAIL }}
     steps:
       - uses: actions/checkout@v4
+      - name: Require maintainer identity
+        run: |
+          if [ -z "${DEBEMAIL}" ]; then
+            echo "::error::Set repository variable DEBEMAIL (Settings > Secrets and variables > Actions > Variables)"
+            exit 1
+          fi
       - name: Install selected Rust toolchain
         run: |
           rustup toolchain install ${{ matrix.toolchain }} --profile minimal --component clippy --component rustfmt
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 598bd50..9aa164f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,8 +12,17 @@ jobs:
   linux-x86_64:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
+    env:
+      DEBFULLNAME: ${{ vars.DEBFULLNAME || 'grloper' }}
+      DEBEMAIL: ${{ vars.DEBEMAIL }}
     steps:
       - uses: actions/checkout@v4
+      - name: Require maintainer identity
+        run: |
+          if [ -z "${DEBEMAIL}" ]; then
+            echo "::error::Set repository variable DEBEMAIL (Settings > Secrets and variables > Actions > Variables)"
+            exit 1
+          fi
       - name: Install stable Rust
         run: |
           rustup toolchain install stable --profile minimal --component clippy --component rustfmt
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 264d38b..f26149a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -57,3 +57,10 @@ post vulnerabilities in public issues; see [SECURITY.md](SECURITY.md).
 A false-positive report should include the Wraith version, kernel, invocation,
 minimal benign reproducer and redacted events. A performance report should include
 baseline and traced timings, sample count, workload and hardware—not only a ratio.
+
+## CI maintainer identity
+
+The Debian package gate requires a real maintainer contact. CI reads the
+repository variables `DEBEMAIL` (required) and `DEBFULLNAME` (defaults to
+`grloper`), set under Settings > Secrets and variables > Actions > Variables.
+For local runs, export `DEBEMAIL` and `DEBFULLNAME` before `scripts/verify.sh`.