diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..6e32490
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,102 @@
+# Builds a signed release APK on every version tag and attaches it to the
+# Gitea release, so Obtainium can track updates. See issue #3.
+#
+# Required repository secrets (Settings → Secrets → Actions):
+#   RELEASE_KEYSTORE_BASE64  — base64 of android/mindlist-release.keystore
+#   RELEASE_STORE_PASSWORD   — keystore password
+#   RELEASE_KEY_ALIAS        — key alias (mindlist)
+#   RELEASE_KEY_PASSWORD     — key password
+#
+# Obtainium: Add App → Gitea → paste the repo URL. If the repo is private,
+# enter an access token (account → Settings → Applications → token with
+# repo scope) in the Obtainium source settings.
+
+name: Release APK
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Setup JDK 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Install SDK packages
+        run: |
+          yes | sdkmanager --licenses > /dev/null
+          sdkmanager "platforms;android-36" "build-tools;36.0.0"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test
+        run: npm test
+
+      - name: Build PWA + sync
+        run: |
+          npm run build
+          npx cap sync android
+
+      - name: Restore release keystore
+        env:
+          KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }}
+          STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
+        run: |
+          test -n "$KEYSTORE_BASE64" || { echo "::error::Missing RELEASE_KEYSTORE_BASE64 secret"; exit 1; }
+          echo "$KEYSTORE_BASE64" | base64 -d > android/mindlist-release.keystore
+          printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
+            "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties
+          echo "sdk.dir=$ANDROID_HOME" > android/local.properties
+
+      - name: Assemble signed release
+        working-directory: android
+        env:
+          JAVA_HOME: ${{ env.JAVA_HOME }}
+        run: ./gradlew assembleRelease
+
+      - name: Verify signature
+        run: $ANDROID_HOME/build-tools/36.0.0/apksigner verify app/build/outputs/apk/release/app-release.apk
+        working-directory: android
+
+      - name: Stage artifact
+        run: cp android/app/build/outputs/apk/release/app-release.apk "mindlist-${GITHUB_REF_NAME}.apk"
+
+      - name: Create Gitea release + upload APK
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          SERVER: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+        run: |
+          REL=$(curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \
+            -d "{\"tag_name\":\"$TAG\",\"name\":\"Mindlist $TAG\",\"draft\":false,\"prerelease\":false}" \
+            "$SERVER/api/v1/repos/$REPO/releases")
+          echo "$REL" | head -c 300; echo
+          RID=$(echo "$REL" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
+          curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/vnd.android.package-archive' \
+            --data-binary "@mindlist-$TAG.apk" \
+            "$SERVER/api/v1/repos/$REPO/releases/$RID/assets?name=mindlist-$TAG.apk"
+          echo; echo "Uploaded mindlist-$TAG.apk to release $RID"