diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 62108b34a..681cb8e16 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -1,10 +1,10 @@
 name: Build Desktop
 
 permissions:
+  actions: write    # needed for ccache action to be able to delete gha caches
+  attestations: write
   contents: write
   id-token: write
-  attestations: write
-  actions: write # needed for ccache action to be able to delete gha caches
 
 on:
   push:
@@ -19,7 +19,6 @@ on:
       - '.github/workflows/desktop-build.yml'
       - 'CMakeLists.txt'
       - 'vcpkg.json'
-      - 'vcpkg'
     tags:
       - '*'
   pull_request:
@@ -32,7 +31,6 @@ on:
       - '.github/workflows/desktop-build.yml'
       - 'CMakeLists.txt'
       - 'vcpkg.json'
-      - 'vcpkg'
 
 # Cancel earlier, unfinished runs of this workflow on the same branch (unless on release)
 concurrency:
@@ -44,8 +42,8 @@ jobs:
     name: Configure
     runs-on: ubuntu-slim
     outputs:
-      tag: ${{steps.configure.outputs.tag}}
-      sha: ${{steps.configure.outputs.sha}}
+      tag: ${{ steps.configure.outputs.tag }}
+      sha: ${{ steps.configure.outputs.sha }}
 
     steps:  
       - name: Configure
@@ -75,7 +73,7 @@ jobs:
         if: steps.configure.outputs.tag != null
         shell: bash
         env:
-          TAG: ${{steps.configure.outputs.tag}}
+          TAG: ${{ steps.configure.outputs.tag }}
         run: .ci/prep_release.sh
 
       - name: Create release
@@ -83,12 +81,12 @@ jobs:
         id: create_release
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-          tag_name: ${{steps.configure.outputs.tag}}
-          target: ${{steps.configure.outputs.sha}}
-          release_name: ${{steps.prepare.outputs.title}}
-          body_path: ${{steps.prepare.outputs.body_path}}
-          prerelease: ${{steps.prepare.outputs.is_beta}}
+          GH_TOKEN: ${{ github.token }}
+          tag_name: ${{ steps.configure.outputs.tag }}
+          target: ${{ steps.configure.outputs.sha }}
+          release_name: ${{ steps.prepare.outputs.title }}
+          body_path: ${{ steps.prepare.outputs.body_path }}
+          prerelease: ${{ steps.prepare.outputs.is_beta }}
         run: |
           if [[ $prerelease == yes ]]; then
             args="--prerelease"
@@ -140,14 +138,14 @@ jobs:
             version: 26.04
             package: DEB
 
-    name: ${{matrix.distro}} ${{matrix.version}}
+    name: ${{ matrix.distro }} ${{ matrix.version }}
     needs: configure
     runs-on: ubuntu-latest
-    continue-on-error: ${{matrix.allow-failure == 'yes'}}
+    continue-on-error: ${{ matrix.allow-failure == 'yes' }}
     timeout-minutes: 70
     env:
-      NAME: ${{matrix.distro}}${{matrix.version}}
-      CACHE: ${{github.workspace}}/.cache/${{matrix.distro}}${{matrix.version}}   # directory for caching docker image and ccache
+      NAME: ${{ matrix.distro }}${{ matrix.version }}
+      CACHE: ${{ github.workspace }}/.cache/${{ matrix.distro }}${{ matrix.version }}   # directory for caching docker image and ccache
       # Cache size over the entire repo is 10Gi:
       # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
       CCACHE_SIZE: 550M
@@ -155,24 +153,24 @@ jobs:
       CMAKE_GENERATOR: 'Ninja'
 
     steps:
-      - name: Checkout
+      - name: "Checkout"
         uses: actions/checkout@v6
 
-      - name: Restore compiler cache (ccache)
+      - name: "Restore compiler cache (ccache)"
         id: ccache_restore
         uses: actions/cache/restore@v5
         env:
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
         with:
-          path: ${{env.CACHE}}
-          key: ccache-${{matrix.distro}}${{matrix.version}}-${{env.BRANCH_NAME}}
-          restore-keys: ccache-${{matrix.distro}}${{matrix.version}}-
+          path: ${{ env.CACHE }}
+          key: ccache-${{ matrix.distro }}${{ matrix.version }}-${{ env.BRANCH_NAME }}
+          restore-keys: ccache-${{ matrix.distro }}${{ matrix.version }}-
 
-      - name: Build ${{matrix.distro}} ${{matrix.version}} Docker image
+      - name: "Build ${{ matrix.distro }} ${{ matrix.version }} Docker image"
         shell: bash
         run: source .ci/docker.sh --build
 
-      - name: Build debug and test
+      - name: "Build debug and test"
         if: matrix.test != 'skip'
         shell: bash
         run: |
@@ -180,14 +178,14 @@ jobs:
           RUN --server --debug --test --ccache "$CCACHE_SIZE" \
                   --cmake-generator "$CMAKE_GENERATOR"
 
-      - name: Build release package
+      - name: "Build release package"
         id: build
         if: matrix.package != 'skip'
         shell: bash
         env:
-          SUFFIX: '-${{matrix.distro}}${{matrix.version}}'
-          package: '${{matrix.package}}'
-          server_only: '${{matrix.server_only}}'
+          SUFFIX: '-${{ matrix.distro }}${{ matrix.version }}'
+          package: '${{ matrix.package }}'
+          server_only: '${{ matrix.server_only }}'
         run: |
           source .ci/docker.sh
           args=()
@@ -203,7 +201,7 @@ jobs:
           RUN --server --release --package "$package" "${args[@]}"
 
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
-      - name: Delete remote compiler cache (ccache)
+      - name: "Delete remote compiler cache (ccache)"
         if: github.ref == 'refs/heads/master' && steps.ccache_restore.outputs.cache-hit
         continue-on-error: true
         env:
@@ -213,47 +211,47 @@ jobs:
             echo "Cache deleted successfully"
           fi
 
-      - name: Save updated compiler cache (ccache)
+      - name: "Save updated compiler cache (ccache)"
         if: github.ref == 'refs/heads/master'
         uses: actions/cache/save@v5
         with:
-          path: ${{env.CACHE}}
+          path: ${{ env.CACHE }
           key: ${{ steps.ccache_restore.outputs.cache-primary-key }}
 
-      - name: Upload artifact
+      - name: "Upload artifact"
         id: upload_artifact
         if: matrix.package != 'skip'
         uses: actions/upload-artifact@v7
         with:
-          path: ${{steps.build.outputs.path}}
+          path: ${{ steps.build.outputs.path }}
           archive: false
           if-no-files-found: error
 
-      - name: Upload to release
+      - name: "Upload to release"
         id: upload_release
         if: matrix.package != 'skip' && needs.configure.outputs.tag != null
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-          tag_name: ${{needs.configure.outputs.tag}}
-          asset_name: ${{steps.build.outputs.fullname}}
-          asset_path: ${{steps.build.outputs.path}}
+          GH_TOKEN: ${{ github.token }}
+          tag_name: ${{ needs.configure.outputs.tag }}
+          asset_name: ${{ steps.build.outputs.fullname }}
+          asset_path: ${{ steps.build.outputs.path }}
         run: gh release upload "$tag_name" "$asset_path#$asset_name"
 
-      - name: Attest binary provenance
+      - name: "Attest binary provenance"
         id: attestation
         if: steps.upload_release.outcome == 'success'
         uses: actions/attest@v4
         with:
-          subject-path: ${{steps.build.outputs.path}}
+          subject-path: ${{ steps.build.outputs.path }}
           show-summary: false
 
-      - name: Verify binary attestation
+      - name: "Verify binary attestation"
         if: steps.attestation.outcome == 'success'
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-        run: gh attestation verify "${{steps.build.outputs.path}}" --repo Cockatrice/Cockatrice
+          GH_TOKEN: ${{ github.token }}
+        run: gh attestation verify "${{ steps.build.outputs.path }}" --repo Cockatrice/Cockatrice
 
   build-vcpkg:
     strategy:
@@ -331,54 +329,54 @@ jobs:
             cmake_generator: "Visual Studio 17 2022"
             cmake_generator_platform: x64
 
-    name: ${{matrix.os}} ${{matrix.target}}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
+    name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
     needs: configure
-    runs-on: ${{matrix.runner}}
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 100
     env:
-      CCACHE_DIR: ${{github.workspace}}/.cache/
+      CCACHE_DIR: ${{ github.workspace }}/.cache/
       # Cache size over the entire repo is 10Gi:
       # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
       CCACHE_SIZE: 550M
 
     steps:
-      - name: Checkout
+      - name: "Checkout"
         uses: actions/checkout@v6
         with:
           submodules: recursive
 
-      - name: Add msbuild to PATH
+      - name: "[Windows] Add msbuild to PATH"
         if: matrix.os == 'Windows'
         id: add-msbuild
         uses: microsoft/setup-msbuild@v3
         with:
           msbuild-architecture: x64
 
-      - name: Setup ccache
-        if: matrix.use_ccache == 1 && matrix.os == 'macOS'
+      - name: "[macOS] Setup ccache"
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1
         run: brew install ccache
 
-      - name: Restore compiler cache (ccache)
-        if: matrix.use_ccache == 1
+      - name: "[macOS] Restore compiler cache (ccache)"
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1
         id: ccache_restore
         uses: actions/cache/restore@v5
         env:
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
         with:
-          path: ${{env.CCACHE_DIR}}
-          key: ccache-${{matrix.runner}}-${{matrix.soc}}-${{matrix.type}}-${{env.BRANCH_NAME}}
-          restore-keys: ccache-${{matrix.runner}}-${{matrix.soc}}-${{matrix.type}}-
+          path: ${{ env.CCACHE_DIR }}
+          key: ccache-${{ matrix.runner }}-${{ matrix.soc }}-${{ matrix.type }}-${{ env.BRANCH_NAME }}
+          restore-keys: ccache-${{ matrix.runner }}-${{ matrix.soc }}-${{ matrix.type }}-
 
-      - name: Install aqtinstall
+      - name: "Install aqtinstall"
         run: pipx install aqtinstall
 
       # Resolve given wildcard versions (e.g. Qt 6.6.*) to latest version via aqtinstall to avoid stale caches on new releases
-      - name: Resolve latest Qt patch version
+      - name: "Resolve latest Qt patch version"
         id: resolve_qt_version
         shell: bash
-        run: .ci/resolve_latest_aqt_qt_version.sh "${{matrix.qt_version}}"
+        run: .ci/resolve_latest_aqt_qt_version.sh "${{ matrix.qt_version }}"
 
-      - name: Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }} libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }} libraries"
         if: matrix.os == 'macOS'
         id: restore_qt
         uses: actions/cache/restore@v5
@@ -387,61 +385,61 @@ jobs:
           key: thin-qt-macos-${{ matrix.soc }}-${{ steps.resolve_qt_version.outputs.version }}
 
       # Using jurplel/install-qt-action to install Qt without using brew
-      # qt build using vcpkg either just fails or takes too long to build
-      - name: Install fat Qt ${{ steps.resolve_qt_version.outputs.version }} (${{ matrix.soc }} macOS)
+      # Qt build using vcpkg either just fails or takes too long to build
+      - name: "[macOS] Install fat Qt ${{ steps.resolve_qt_version.outputs.version }}"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         uses: jurplel/install-qt-action@v4
         with:
           version: ${{ steps.resolve_qt_version.outputs.version }}
-          arch: ${{matrix.qt_arch}}
-          modules: ${{matrix.qt_modules}}
+          arch: ${{ matrix.qt_arch }}
+          modules: ${{ matrix.qt_modules }}
           cache: false
-          dir: ${{github.workspace}}
+          dir: ${{ github.workspace }}
 
-      - name: Thin Qt libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Create thin Qt libraries"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         run: .ci/thin_macos_qtlib.sh
 
-      - name: Cache thin Qt libraries (${{ matrix.soc }} macOS)
+      - name: "[macOS] Cache thin Qt libraries"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         uses: actions/cache/save@v5
         with:
           path: ${{ github.workspace }}/Qt
           key: thin-qt-macos-${{ matrix.soc }}-${{ steps.resolve_qt_version.outputs.version }}
 
-      - name: Install Qt ${{matrix.qt_version}} (Windows)
+      - name: "[Windows] Install Qt ${{matrix.qt_version}}"
         if: matrix.os == 'Windows'
         uses: jurplel/install-qt-action@v4
         with:
           # qt 6.11.0 only works with aqtinstall directly from git until aqtinstall 3.4 is released
           aqtsource: git+https://github.com/miurahr/aqtinstall.git
           version: ${{ steps.resolve_qt_version.outputs.version }}
-          arch: ${{matrix.qt_arch}}
-          modules: ${{matrix.qt_modules}}
+          arch: ${{ matrix.qt_arch }}
+          modules: ${{ matrix.qt_modules }}
           cache: true
 
-      - name: Install NSIS
+      - name: "[Windows] Install NSIS"
         if: matrix.os == 'Windows'
         shell: bash
         run: choco install nsis
 
-      - name: Setup vcpkg cache
+      - name: "Setup vcpkg cache"
         id: vcpkg-cache
         uses: TAServers/vcpkg-cache@v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       # uses environment variables, see compile.sh for more details
-      - name: Build Cockatrice
+      - name: "Build Cockatrice"
         id: build
         shell: bash
         env:
-          BUILDTYPE: '${{matrix.type}}'
-          MAKE_PACKAGE: '${{matrix.make_package}}'
-          PACKAGE_SUFFIX: '${{matrix.package_suffix}}'
-          CMAKE_GENERATOR: ${{matrix.cmake_generator}}
-          CMAKE_GENERATOR_PLATFORM: ${{matrix.cmake_generator_platform}}
-          USE_CCACHE: ${{matrix.use_ccache}}
+          BUILDTYPE: '${{ matrix.type }}'
+          MAKE_PACKAGE: '${{ matrix.make_package }}'
+          PACKAGE_SUFFIX: '${{ matrix.package_suffix }}'
+          CMAKE_GENERATOR: ${{ matrix.cmake_generator }}
+          CMAKE_GENERATOR_PLATFORM: ${{ matrix.cmake_generator_platform }}
+          USE_CCACHE: ${{ matrix.use_ccache }}
           VCPKG_DISABLE_METRICS: 1
           VCPKG_BINARY_SOURCES: 'clear;files,${{ steps.vcpkg-cache.outputs.path }},readwrite'
           # macOS-specific environment variables, will be ignored on Windows
@@ -449,14 +447,14 @@ jobs:
           MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
           MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
           MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
-          DEVELOPER_DIR: '/Applications/Xcode_${{matrix.xcode}}.app/Contents/Developer'
+          DEVELOPER_DIR: '/Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer'
           TARGET_MACOS_VERSION: ${{ matrix.override_target }}
           CCACHE_EVICTION_AGE: ${{ matrix.ccache_eviction_age }}
         run: .ci/compile.sh --server --test --vcpkg
 
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
-      - name: Delete remote compiler cache (ccache)
-        if: github.ref == 'refs/heads/master' && matrix.use_ccache == 1 && steps.ccache_restore.outputs.cache-hit
+      - name: "[macOS] Delete remote compiler cache (ccache)"
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master' && steps.ccache_restore.outputs.cache-hit
         continue-on-error: true
         env:
           GH_TOKEN: ${{ github.token }}
@@ -465,14 +463,14 @@ jobs:
             echo "Cache deleted successfully"
           fi
 
-      - name: Save updated compiler cache (ccache)
-        if: github.ref == 'refs/heads/master' && matrix.use_ccache == 1
+      - name: "[macOS] Save updated compiler cache (ccache)"
+        if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master'
         uses: actions/cache/save@v5
         with:
-          path: ${{env.CCACHE_DIR}}
+          path: ${{ env.CCACHE_DIR }}
           key: ${{ steps.ccache_restore.outputs.cache-primary-key }}
 
-      - name: Sign app bundle
+      - name: "[macOS] Sign app bundle"
         if: matrix.os == 'macOS' && matrix.make_package && needs.configure.outputs.tag != null
         id: sign_macos
         env:
@@ -482,11 +480,11 @@ jobs:
           if [[ -n "$MACOS_CERTIFICATE_NAME" ]]
           then
             security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
-            /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "${{steps.build.outputs.path}}"
+            /usr/bin/codesign --sign="$MACOS_CERTIFICATE_NAME" --entitlements=".ci/macos.entitlements" --options=runtime --force --deep --timestamp --verbose "${{ steps.build.outputs.path }}"
           fi
 
-      - name: Notarize app bundle
-        if: steps.sign_macos.outcome == 'success'
+      - name: "[macOS] Notarize app bundle"
+        if: matrix.os == 'macOS' && steps.sign_macos.outcome == 'success'
         env:
           MACOS_NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
           MACOS_NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
@@ -502,7 +500,7 @@ jobs:
             # Therefore, we create a zip file containing our app bundle, so that we can send it to the
             # notarization service
             echo "Creating temp notarization archive"
-            ditto -c -k --keepParent "${{steps.build.outputs.path}}" "notarization.zip"
+            ditto -c -k --keepParent "${{ steps.build.outputs.path }}" "notarization.zip"
 
             # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
             # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
@@ -514,51 +512,51 @@ jobs:
             # Finally, we need to "attach the staple" to our executable, which will allow our app to be
             # validated by macOS even when an internet connection is not available.
             echo "Attach staple"
-            xcrun stapler staple "${{steps.build.outputs.path}}"
+            xcrun stapler staple "${{ steps.build.outputs.path }}"
           fi
 
-      - name: Upload artifact
+      - name: "Upload artifact"
         if: matrix.make_package
         id: upload_artifact
         uses: actions/upload-artifact@v7
         with:
-          path: ${{steps.build.outputs.path}}
+          path: ${{ steps.build.outputs.path }}
           archive: false
           if-no-files-found: error
 
-      - name: Upload PDBs (Program Databases)
+      - name: "[Windows] Upload PDBs (Program Databases)"
         if: matrix.os == 'Windows' && github.ref_type != 'tag'
         uses: actions/upload-artifact@v7
         with:
-          name: ${{steps.build.outputs.name}}-PDBs
+          name: ${{ steps.build.outputs.name }}-PDBs
           path: |
             build/cockatrice/Release/*.pdb
             build/oracle/Release/*.pdb
             build/servatrice/Release/*.pdb
           if-no-files-found: error
 
-      - name: Upload to release
+      - name: "Upload to release"
         if: needs.configure.outputs.tag != null && matrix.make_package == '1'
         id: upload_release
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-          tag_name: ${{needs.configure.outputs.tag}}
-          asset_name: ${{steps.build.outputs.fullname}}
-          asset_path: ${{steps.build.outputs.path}}
+          GH_TOKEN: ${{ github.token }}
+          tag_name: ${{ needs.configure.outputs.tag }}
+          asset_name: ${{ steps.build.outputs.fullname }}
+          asset_path: ${{ steps.build.outputs.path }}
         run: gh release upload "$tag_name" "$asset_path#$asset_name"
 
-      - name: Attest binary provenance
+      - name: "Attest binary provenance"
         if: steps.upload_release.outcome == 'success'
         id: attestation
         uses: actions/attest@v4
         with:
-          subject-path: ${{steps.build.outputs.path}}
+          subject-path: ${{ steps.build.outputs.path }}
           show-summary: false
 
-      - name: Verify binary attestation
+      - name: "Verify binary attestation"
         if: steps.attestation.outcome == 'success'
         shell: bash
         env:
-          GH_TOKEN: ${{github.token}}
-        run: gh attestation verify "${{steps.build.outputs.path}}" --repo Cockatrice/Cockatrice
+          GH_TOKEN: ${{ github.token }}
+        run: gh attestation verify "${{ steps.build.outputs.path }}" --repo Cockatrice/Cockatrice