diff --git a/.gitignore b/.gitignore
index 7672c51..a704549 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,8 @@
 .externalNativeBuild
 .cxx
 /receiver/receiver
+
+# Never commit signing secrets
+/keystore.properties
+*.jks
+*.keystore
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 4a601ac..9de67a9 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -1,3 +1,5 @@
+import java.util.Properties
+
 plugins {
     alias(libs.plugins.android.application)
     alias(libs.plugins.kotlin.android)
@@ -16,6 +18,25 @@ android {
         versionName = "1.0"
     }
 
+    // Release signing is enabled only when keystore.properties is present (local
+    // release builds). F-Droid's build server has no such file, so it builds
+    // unsigned; F-Droid then verifies the developer-published APK reproduces.
+    // Signing via the Gradle build (not external apksigner) keeps the APK's zip
+    // layout identical to the unsigned build, which is required for apksigcopier.
+    val keystorePropsFile = rootProject.file("keystore.properties")
+    val releaseSigning = if (keystorePropsFile.exists()) {
+        val props = Properties()
+        keystorePropsFile.inputStream().use { props.load(it) }
+        signingConfigs.create("release") {
+            storeFile = rootProject.file(props.getProperty("storeFile"))
+            storePassword = props.getProperty("storePassword")
+            keyAlias = props.getProperty("keyAlias")
+            keyPassword = props.getProperty("keyPassword")
+        }
+    } else {
+        null
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = false
@@ -23,6 +44,7 @@ android {
                 getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro",
             )
+            signingConfig = releaseSigning
         }
     }