diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c123777..43acca18 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -103,10 +103,21 @@ jobs:
           echo "code=$CODE" >> "$GITHUB_OUTPUT"
           echo "Release: tag=$TAG version=$VERSION code=$CODE"
 
+      - name: Decode release keystore
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+        run: |
+          echo "$KEYSTORE_BASE64" | base64 -d > hermes-control-release.keystore.jks
+          ls -lh hermes-control-release.keystore.jks
+
       - name: Build Release APK
         env:
           VERSION_NAME: ${{ steps.version.outputs.version }}
           VERSION_CODE: ${{ steps.version.outputs.code }}
+          KEYSTORE_PATH: ${{ github.workspace }}/hermes-control-release.keystore.jks
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: |
           ./gradlew assembleRelease \
             -PversionName="$VERSION_NAME" \
diff --git a/.gitignore b/.gitignore
index e64941ef..b44b50a3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,15 +1,14 @@
-*.iml
-.gradle
-.gradle-home
-$PWD
-.agents
-*.log
-/local.properties
-/.idea
-.DS_Store
-/build
-/captures
-.externalNativeBuild
-.cxx
+# Release keystore (local copy — stored as GitHub secret)
+hermes-control-release.keystore.jks
+
+# Android / Gradle
+build/
+.gradle/
 local.properties
-*.apk
+*.iml
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 22a1c32a..7133a772 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -21,12 +21,21 @@ android {
         versionName = (project.findProperty("versionName") as? String) ?: "1.0-dev"
     }
 
+    signingConfigs {
+        create("release") {
+            storeFile = file(System.getenv("KEYSTORE_PATH") ?: "hermes-control-release.keystore.jks")
+            storePassword = System.getenv("KEYSTORE_PASSWORD") ?: "hermes_release"
+            keyAlias = System.getenv("KEY_ALIAS") ?: "hermes-control-release"
+            keyPassword = System.getenv("KEY_PASSWORD") ?: "hermes_release"
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
-            signingConfig = signingConfigs.getByName("debug")
+            signingConfig = signingConfigs["release"]
         }
     }
     compileOptions {