diff --git a/.github/actions/fetch-nip44/action.yml b/.github/actions/fetch-nip44/action.yml
new file mode 100644
index 0000000..5745da6
--- /dev/null
+++ b/.github/actions/fetch-nip44/action.yml
@@ -0,0 +1,21 @@
+name: Fetch nip44 crate
+description: >
+  Clone the nip44 crate (v2 + v3 encryption) from our mirror
+  (github.com/2ro/nip44, branch `v3`) into ../nip44, so the
+  `nip44 = { path = "../nip44" }` dependency resolves.
+
+runs:
+  using: composite
+  steps:
+    - name: Clone nip44
+      shell: bash
+      run: |
+        set -euo pipefail
+        DEST="$(dirname "$GITHUB_WORKSPACE")/nip44"
+        if [ -e "$DEST/Cargo.toml" ]; then
+          echo "nip44 already present at $DEST"
+          exit 0
+        fi
+        rm -rf "$DEST"
+        git clone --branch v3 --depth 1 https://github.com/2ro/nip44.git "$DEST"
+        echo "nip44 cloned from 2ro/nip44@v3 -> $DEST"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 28ad585..fb5f11d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,6 +40,7 @@ jobs:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
       - uses: ./.github/actions/fetch-nym
+      - uses: ./.github/actions/fetch-nip44
       - name: Build
         shell: bash
         run: GOBLIN_BUILD="${TAG#build}" cargo build --release
@@ -65,6 +66,7 @@ jobs:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
       - uses: ./.github/actions/fetch-nym
+      - uses: ./.github/actions/fetch-nip44
       - name: Build
         shell: bash
         run: GOBLIN_BUILD="${TAG#build}" cargo build --release
@@ -112,6 +114,7 @@ jobs:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
       - uses: ./.github/actions/fetch-nym
+      - uses: ./.github/actions/fetch-nip44
       - name: Build both architectures
         run: |
           export GOBLIN_BUILD="${TAG#build}"