diff --git a/.github/workflows/gradle.yaml b/.github/workflows/gradle.yaml
index 92c2c2e70..96475b37e 100644
--- a/.github/workflows/gradle.yaml
+++ b/.github/workflows/gradle.yaml
@@ -65,7 +65,7 @@ jobs:
         uses: gradle/actions/setup-gradle@v5
 
       - name: Build with Gradle
-        run: ./gradlew shadowJar
+        run: ./gradlew :server:desktop:shadowJar
 
       - name: Upload the Server JAR as a Build Artifact
         uses: actions/upload-artifact@v5
@@ -113,13 +113,24 @@ jobs:
       - name: Install dependencies
         run: pnpm i
 
-      - name: Build
+      - name: Build GUI
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
         run: cd gui && pnpm run build
 
+      - name: Decode keystore secret to file
+        env:
+          ANDROID_STORE_FILE: ${{ secrets.ANDROID_STORE_FILE }}
+        run: |
+          mkdir -p server/android/secrets/
+          echo $ANDROID_STORE_FILE | base64 --decode > server/android/secrets/keystore.jks
+
       - name: Build with Gradle
-        run: ./gradlew :server:android:assembleDebug
+        run: ./gradlew :server:android:build
+        env:
+          ANDROID_STORE_PASSWD: ${{ secrets.ANDROID_STORE_PASSWD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWD: ${{ secrets.ANDROID_KEY_PASSWD }}
 
       - name: Upload the Android Build Artifact
         uses: actions/upload-artifact@v5
@@ -132,7 +143,7 @@ jobs:
       - name: Prepare for release
         if: startsWith(github.ref, 'refs/tags/')
         run: |
-          cp server/android/build/outputs/apk/debug/android-debug.apk ./SlimeVR-android.apk
+          cp server/android/build/outputs/apk/release/android-release.apk ./SlimeVR-android.apk
 
       - name: Upload to draft release
         uses: softprops/action-gh-release@v2
diff --git a/server/android/.gitignore b/server/android/.gitignore
index 755ee59ff..c39472d4b 100644
--- a/server/android/.gitignore
+++ b/server/android/.gitignore
@@ -1,2 +1,3 @@
 /build
 /src/main/resources/web-gui
+/secrets
diff --git a/server/android/build.gradle.kts b/server/android/build.gradle.kts
index cf73dd236..54afaf0a0 100644
--- a/server/android/build.gradle.kts
+++ b/server/android/build.gradle.kts
@@ -37,8 +37,17 @@ tasks.register<Copy>("copyGuiAssets") {
 		throw GradleException("You need to run \"pnpm run build\" on the gui folder first!")
 	}
 }
+tasks.register("validateKeyStore") {
+	val storeFile = android.buildTypes.getByName("release").signingConfig?.storeFile
+	// Only warn for now since this is run even when irrelevant
+	if (storeFile?.isFile != true) {
+		logger.error("Android KeyStore file does not exist or is not a file: ${storeFile?.path}")
+	} else if (storeFile.length() <= 0) {
+		logger.error("Android KeyStore file is empty: ${storeFile.path}")
+	}
+}
 tasks.preBuild {
-	dependsOn(":server:android:copyGuiAssets")
+	dependsOn(":server:android:copyGuiAssets", ":server:android:validateKeyStore")
 }
 
 tasks.withType<KotlinCompile> {
@@ -134,6 +143,15 @@ android {
 		testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 	}
 
+	signingConfigs {
+		create("release") {
+			storeFile = file("./secrets/keystore.jks")
+			storePassword = System.getenv("ANDROID_STORE_PASSWD")
+			keyAlias = System.getenv("ANDROID_KEY_ALIAS")
+			keyPassword = System.getenv("ANDROID_KEY_PASSWD")
+		}
+	}
+
 	/*	The buildTypes block is where you can configure multiple build types.
 		By default, the build system defines two build types: debug and release. The
 		debug build type is not explicitly shown in the default build configuration,
@@ -152,6 +170,7 @@ android {
 				getDefaultProguardFile("proguard-android-optimize.txt"),
 				"proguard-rules.pro",
 			)
+			signingConfig = signingConfigs.getByName("release")
 		}
 	}