diff --git a/tekton/tests/darwin-mac-credentials.test.ts b/tekton/tests/darwin-mac-credentials.test.ts
new file mode 100644
index 0000000000..8c98e8cb87
--- /dev/null
+++ b/tekton/tests/darwin-mac-credentials.test.ts
@@ -0,0 +1,123 @@
+import { assert, assertEquals } from "jsr:@std/assert@1.0.11";
+import { parseAll } from "jsr:@std/yaml@1.0.9";
+import {
+  evaluate,
+  load,
+  payload,
+  root,
+  type Trigger,
+} from "./trigger-test-utils.ts";
+
+type NamedTrigger = Trigger & {
+  metadata: { name: string };
+  spec: Trigger["spec"] & {
+    bindings: { name?: string; value?: string; ref?: string }[];
+  };
+};
+
+type Overlay = { key: string; expression: string };
+
+const fakeGithubDir =
+  "tekton/v1/triggers/triggers/env-gcp/_/fake-github/";
+const communityPath =
+  "tekton/v1/triggers/triggers/env-gcp/_/git-push-branch-build-community-darwin.yaml";
+
+const fakeGithubTriggers: [string, string][] = [
+  ["fake-github-branch-push-darwin.yaml", "branch-push"],
+  ["fake-github-pr-darwin.yaml", "pr"],
+  ["fake-github-tag-create-darwin.yaml", "tag-create"],
+  ["fake-github-branch-push.yaml", "branch-push"],
+  ["fake-github-pr.yaml", "pr"],
+  ["fake-github-tag-create.yaml", "tag-create"],
+];
+
+function overlays(trigger: Trigger): Overlay[] {
+  const interceptor = trigger.spec.interceptors.find((item) =>
+    item.params.some((param) => param.name === "overlays")
+  );
+  const param = interceptor?.params.find((item) => item.name === "overlays");
+  if (!param || typeof param.value === "string") {
+    throw new Error("missing overlays interceptor");
+  }
+  return param.value as Overlay[];
+}
+
+function overlayExpression(trigger: Trigger, key: string): string {
+  const overlay = overlays(trigger).find((item) => item.key === key);
+  if (!overlay) throw new Error(`missing overlay ${key}`);
+  return overlay.expression;
+}
+
+function mapValue(value: unknown, key: string): unknown {
+  if (
+    value && typeof value === "object" && "get" in value &&
+    typeof (value as { get?: unknown }).get === "function"
+  ) {
+    return (value as { get: (key: string) => unknown }).get(key);
+  }
+  throw new Error(`CEL result is not a map: ${String(value)}`);
+}
+
+function darwinHeader(): Record<string, string> {
+  return {
+    "ce-paramplatform": "darwin/amd64",
+    "ce-paramproduct": "tiflash",
+    "ce-paramprofile": "",
+    "ce-paramplugingitref": "",
+    "ce-parambuilderimage": "",
+  };
+}
+
+function byName(triggers: NamedTrigger[], name: string): NamedTrigger {
+  const trigger = triggers.find((item) => item.metadata.name === name);
+  if (!trigger) throw new Error(`missing trigger ${name}`);
+  return trigger;
+}
+
+function assertSecret(
+  trigger: Trigger,
+  key: string,
+  kind: string,
+  fullName: string,
+  want: string,
+) {
+  const expression = overlayExpression(trigger, key);
+  const body = payload(fullName, kind);
+  const value = key === "custom-params"
+    ? mapValue(evaluate(expression, body, darwinHeader()), "git-secret-ref")
+    : evaluate(expression, body);
+  assertEquals(value, want, `${fullName} ${key}`);
+}
+
+Deno.test("darwin triggers pass github-ssh-secret for tiflash", async (t) => {
+  for (const [file, kind] of fakeGithubTriggers) {
+    await t.step(file, () => {
+      const trigger = load<Trigger>(`${fakeGithubDir}${file}`);
+      assertSecret(trigger, "custom-params", kind, "pingcap/tiflash", "github-ssh-secret");
+      assertSecret(trigger, "custom-params", kind, "pingcap-inc/tici", "github-pat-secret");
+      assertSecret(trigger, "custom-params", kind, "tikv/tikv", "");
+    });
+  }
+
+  const community = parseAll(
+    Deno.readTextFileSync(new URL(communityPath, root)),
+  ) as NamedTrigger[];
+  for (
+    const name of [
+      "github-push-build-community-darwin",
+      "github-push-build-community-fts-darwin",
+    ]
+  ) {
+    await t.step(name, () => {
+      const trigger = byName(community, name);
+      assertEquals(trigger.spec.template.ref, "build-component-darwin-mac");
+      assert(
+        trigger.spec.bindings.some((binding) => binding.name === "git-secret-ref"),
+        "community trigger must bind git-secret-ref",
+      );
+      assertSecret(trigger, "git-secret-ref", "branch-push", "pingcap/tiflash", "github-ssh-secret");
+      assertSecret(trigger, "git-secret-ref", "branch-push", "pingcap/tidb", "");
+      assertSecret(trigger, "git-secret-ref", "branch-push", "tikv/tikv", "");
+    });
+  }
+});
diff --git a/tekton/v1/pipelines/kustomization.yaml b/tekton/v1/pipelines/kustomization.yaml
index 9bb93e65db..329e81a5d3 100644
--- a/tekton/v1/pipelines/kustomization.yaml
+++ b/tekton/v1/pipelines/kustomization.yaml
@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - pingcap-build-package-darwin.yaml
   - pingcap-build-package-darwin-mac.yaml
+  - pingcap-build-package-darwin.yaml
   - pingcap-build-package-linux.yaml
   - pingcap-release-ga.yaml
diff --git a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-branch-push-darwin.yaml b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-branch-push-darwin.yaml
index ca27358ee6..3add74d589 100644
--- a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-branch-push-darwin.yaml
+++ b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-branch-push-darwin.yaml
@@ -140,7 +140,7 @@ spec:
                   'arch': header.canonical('ce-paramPlatform').split('/')[1],
                   'external-git-ref': header.canonical('ce-paramPluginGitRef').replace('branch/', '').replace('tag/', ''),
                   'fetch-external': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') == 'enterprise') ? 'true' : 'false',
-                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : '',
+                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : (body.repository.full_name == 'pingcap/tiflash' ? 'github-ssh-secret' : ''),
                   'submodules': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') != 'enterprise') ? 'false' : 'true',
                 }
             - key: component
diff --git a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-branch-push.yaml b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-branch-push.yaml
index 66add1c224..b0b2b2d940 100644
--- a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-branch-push.yaml
+++ b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-branch-push.yaml
@@ -140,7 +140,7 @@ spec:
                   'profile': header.canonical('ce-paramProfile') == '' ? 'release' : (header.canonical('ce-paramProfile') == 'community' ? 'release' : header.canonical('ce-paramProfile')),
                   'external-git-ref': header.canonical('ce-paramPluginGitRef').replace('branch/', '').replace('tag/', ''),
                   'fetch-external': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') == 'enterprise') ? 'true' : 'false',
-                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : '',
+                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : (body.repository.full_name == 'pingcap/tiflash' ? 'github-ssh-secret' : ''),
                   'submodules': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') != 'enterprise') ? 'false' : 'true',
                 }
             - key: component
diff --git a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-pr-darwin.yaml b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-pr-darwin.yaml
index 44478af968..606d6cf7ae 100644
--- a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-pr-darwin.yaml
+++ b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-pr-darwin.yaml
@@ -140,7 +140,7 @@ spec:
                   'arch': header.canonical('ce-paramPlatform').split('/')[1],
                   'external-git-ref': header.canonical('ce-paramPluginGitRef').replace('branch/', '').replace('tag/', ''),
                   'fetch-external': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') == 'enterprise') ? 'true' : 'false',
-                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : '',
+                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : (body.repository.full_name == 'pingcap/tiflash' ? 'github-ssh-secret' : ''),
                   'submodules': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') != 'enterprise') ? 'false' : 'true',
                 }
             - key: component
diff --git a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-pr.yaml b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-pr.yaml
index b858678f05..6b5b191a86 100644
--- a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-pr.yaml
+++ b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-pr.yaml
@@ -140,7 +140,7 @@ spec:
                   'profile': header.canonical('ce-paramProfile') == '' ? 'release' : (header.canonical('ce-paramProfile') == 'community' ? 'release' : header.canonical('ce-paramProfile')),
                   'external-git-ref': header.canonical('ce-paramPluginGitRef').replace('branch/', '').replace('tag/', ''),
                   'fetch-external': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') == 'enterprise') ? 'true' : 'false',
-                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : '',
+                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : (body.repository.full_name == 'pingcap/tiflash' ? 'github-ssh-secret' : ''),
                   'submodules': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') != 'enterprise') ? 'false' : 'true',
                 }
             - key: component
diff --git a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-tag-create-darwin.yaml b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-tag-create-darwin.yaml
index 11820ac751..a483ddc455 100644
--- a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-tag-create-darwin.yaml
+++ b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-tag-create-darwin.yaml
@@ -142,7 +142,7 @@ spec:
                   'arch': header.canonical('ce-paramPlatform').split('/')[1],
                   'external-git-ref': header.canonical('ce-paramPluginGitRef').replace('branch/', '').replace('tag/', ''),
                   'fetch-external': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') == 'enterprise') ? 'true' : 'false',
-                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : '',
+                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : (body.repository.full_name == 'pingcap/tiflash' ? 'github-ssh-secret' : ''),
                   'submodules': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') != 'enterprise') ? 'false' : 'true',
                 }
             - key: component
diff --git a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-tag-create.yaml b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-tag-create.yaml
index 6316b747e4..e2cf913af7 100644
--- a/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-tag-create.yaml
+++ b/tekton/v1/triggers/triggers/env-gcp/_/fake-github/fake-github-tag-create.yaml
@@ -140,7 +140,7 @@ spec:
                   'profile': header.canonical('ce-paramProfile') == '' ? 'release' : (header.canonical('ce-paramProfile') == 'community' ? 'release' : header.canonical('ce-paramProfile')),
                   'external-git-ref': header.canonical('ce-paramPluginGitRef').replace('branch/', '').replace('tag/', ''),
                   'fetch-external': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') == 'enterprise') ? 'true' : 'false',
-                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : '',
+                  'git-secret-ref': body.repository.full_name == 'pingcap-inc/tici' ? 'github-pat-secret' : (body.repository.full_name == 'pingcap/tiflash' ? 'github-ssh-secret' : ''),
                   'submodules': (body.repository.name == 'tidb' && header.canonical('ce-paramProfile') != 'enterprise') ? 'false' : 'true',
                 }
             - key: component
diff --git a/tekton/v1/triggers/triggers/env-gcp/_/git-push-branch-build-community-darwin.yaml b/tekton/v1/triggers/triggers/env-gcp/_/git-push-branch-build-community-darwin.yaml
index 3add01beda..3f38a86f89 100644
--- a/tekton/v1/triggers/triggers/env-gcp/_/git-push-branch-build-community-darwin.yaml
+++ b/tekton/v1/triggers/triggers/env-gcp/_/git-push-branch-build-community-darwin.yaml
@@ -47,6 +47,9 @@ spec:
             - key: submodules
               expression: >-
                 body.repository.name == 'tidb' ? 'false' : 'true'
+            - key: git-secret-ref
+              expression: >-
+                body.repository.full_name == 'pingcap/tiflash' ? 'github-ssh-secret' : ''
             - key: timeout
               expression: >-
                 {
@@ -111,6 +114,7 @@ spec:
     - { name: timeout, value: $(extensions.timeout) }
     - { name: source-ws-size, value: $(extensions.source-ws-size) }
     - { name: submodules, value: $(extensions.submodules) }
+    - { name: git-secret-ref, value: $(extensions.git-secret-ref) }
     - name: builder-resources-cpu
       value: $(extensions.builder-resources-cpu)
     - name: builder-resources-memory
@@ -141,6 +145,9 @@ spec:
             - key: submodules
               expression: >-
                 body.repository.name == 'tidb' ? 'false' : 'true'
+            - key: git-secret-ref
+              expression: >-
+                body.repository.full_name == 'pingcap/tiflash' ? 'github-ssh-secret' : ''
             - key: timeout
               expression: >-
                 {
@@ -177,6 +184,7 @@ spec:
     - { name: timeout, value: $(extensions.timeout) }
     - { name: source-ws-size, value: $(extensions.source-ws-size) }
     - { name: submodules, value: $(extensions.submodules) }
+    - { name: git-secret-ref, value: $(extensions.git-secret-ref) }
     - name: builder-resources-cpu
       value: $(extensions.builder-resources-cpu)
     - name: builder-resources-memory