diff --git a/.github/workflows/composites/env-variables/action.yaml b/.github/workflows/composites/env-variables/action.yaml
index 856e7783ac..d731d932bd 100644
--- a/.github/workflows/composites/env-variables/action.yaml
+++ b/.github/workflows/composites/env-variables/action.yaml
@@ -40,3 +40,30 @@ runs:
           echo "MAVEN_SETTINGS=" >> $GITHUB_ENV
           echo "Maven settings: none found, using Maven defaults"
         fi
+
+        # Artifactory credentials for the settings file selected above.
+        #
+        # release-ci-settings.xml resolves its <server> entries from
+        # ${env.COMMERCIAL_ARTIFACTORY_USERNAME} / ${env.COMMERCIAL_ARTIFACTORY_PASSWORD},
+        # so those must exist in the environment or every request to commercial
+        # Artifactory is unauthenticated and fails with a 401.
+        #
+        # PASSWORD/USERNAME are the read-write commercial secrets and are empty on pull
+        # requests (and in OSS repos, where the secrets do not exist), in which case the
+        # read-only secrets are used instead. Resolving dependencies only needs read
+        # access, so a PR build still works.
+        if [[ -z $PASSWORD ]]; then
+          echo "COMMERCIAL_ARTIFACTORY_PASSWORD is not set, using the read only secret"
+          echo "COMMERCIAL_ARTIFACTORY_PASSWORD=${RO_PASSWORD}" >> $GITHUB_ENV
+        else
+          echo "COMMERCIAL_ARTIFACTORY_PASSWORD is set"
+          echo "COMMERCIAL_ARTIFACTORY_PASSWORD=${PASSWORD}" >> $GITHUB_ENV
+        fi
+
+        if [[ -z $USERNAME ]]; then
+          echo "COMMERCIAL_ARTIFACTORY_USERNAME is not set, using the read only secret"
+          echo "COMMERCIAL_ARTIFACTORY_USERNAME=${RO_USERNAME}" >> $GITHUB_ENV
+        else
+          echo "COMMERCIAL_ARTIFACTORY_USERNAME is set"
+          echo "COMMERCIAL_ARTIFACTORY_USERNAME=${USERNAME}" >> $GITHUB_ENV
+        fi
diff --git a/.github/workflows/maven.yaml b/.github/workflows/maven.yaml
index d1d9c624b7..db7a81c602 100644
--- a/.github/workflows/maven.yaml
+++ b/.github/workflows/maven.yaml
@@ -80,6 +80,15 @@ jobs:
           echo "branch_safe=${SANITIZED_BRANCH}" >> $GITHUB_OUTPUT
 
       - name: set env variables
+        env:
+          # Read-write commercial credentials, deliberately blank on pull requests so that
+          # forked PRs fall back to the read-only secrets. The composite picks whichever
+          # pair is populated and exports COMMERCIAL_ARTIFACTORY_USERNAME/PASSWORD, which
+          # release-ci-settings.xml interpolates to reach commercial Artifactory.
+          PASSWORD: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || '' }}
+          USERNAME: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || '' }}
+          RO_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_RO_PASSWORD }}
+          RO_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_RO_USERNAME }}
         uses: ./.github/workflows/composites/env-variables
 
       - name: setup project jdk
@@ -174,6 +183,15 @@ jobs:
         uses: ./.github/workflows/composites/clean-space
 
       - name: set env variables
+        env:
+          # Read-write commercial credentials, deliberately blank on pull requests so that
+          # forked PRs fall back to the read-only secrets. The composite picks whichever
+          # pair is populated and exports COMMERCIAL_ARTIFACTORY_USERNAME/PASSWORD, which
+          # release-ci-settings.xml interpolates to reach commercial Artifactory.
+          PASSWORD: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || '' }}
+          USERNAME: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || '' }}
+          RO_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_RO_PASSWORD }}
+          RO_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_RO_USERNAME }}
         uses: ./.github/workflows/composites/env-variables
 
       - name: setup project jdk
@@ -232,6 +250,15 @@ jobs:
         uses: ./.github/workflows/composites/clean-space
 
       - name: set env variables
+        env:
+          # Read-write commercial credentials, deliberately blank on pull requests so that
+          # forked PRs fall back to the read-only secrets. The composite picks whichever
+          # pair is populated and exports COMMERCIAL_ARTIFACTORY_USERNAME/PASSWORD, which
+          # release-ci-settings.xml interpolates to reach commercial Artifactory.
+          PASSWORD: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || '' }}
+          USERNAME: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || '' }}
+          RO_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_RO_PASSWORD }}
+          RO_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_RO_USERNAME }}
         uses: ./.github/workflows/composites/env-variables
 
       - name: setup project jdk