diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index 556f0fe..bcaa894 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -1 +1,79 @@
-name: Build Android

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

env:
  NODE_VERSION: '20'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Install dependencies
        run: npm ci

      - name: Build web assets
        run: npm run build

      - name: Setup Capacitor
        run: npx cap sync android

      - name: Build Android APK (debug)
        run: |
          cd android
          ./gradlew assembleDebug

      - name: Build Android AAB (release unsigned)
        run: |
          cd android
          ./gradlew bundleRelease

      - name: Upload APK
        uses: actions/upload-artifact@v4
        with:
          name: android-debug-apk
          path: android/app/build/outputs/apk/debug/app-debug.apk

      - name: Upload AAB
        uses: actions/upload-artifact@v4
        with:
          name: android-release-aab
          path: android/app/build/outputs/bundle/release/app-release.aab

+name: Build Android
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+    branches: [ main, master ]
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: '20.19.0'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+
+      - name: Expose Node runtime for Gradle subprocesses
+        run: |
+          echo "NODE_BINARY=$(command -v node)" >> "$GITHUB_ENV"
+          echo "NODE_BIN_DIR=$(dirname \"$(command -v node)\")" >> "$GITHUB_ENV"
+          node --version
+          npm --version
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build web assets
+        run: npm run build
+
+      - name: Setup Capacitor
+        run: npx cap sync android
+
+      - name: Ensure Gradle wrapper is executable
+        run: chmod +x android/gradlew
+
+      - name: Build Android APK (debug)
+        env:
+          PATH: ${{ env.NODE_BIN_DIR }}:${{ env.PATH }}
+          NODE_BINARY: ${{ env.NODE_BINARY }}
+        run: |
+          cd android
+          ./gradlew assembleDebug --stacktrace
+
+      - name: Build Android AAB (release unsigned)
+        env:
+          PATH: ${{ env.NODE_BIN_DIR }}:${{ env.PATH }}
+          NODE_BINARY: ${{ env.NODE_BINARY }}
+        run: |
+          cd android
+          ./gradlew bundleRelease --stacktrace
+
+      - name: Upload APK
+        uses: actions/upload-artifact@v4
+        with:
+          name: android-debug-apk
+          path: android/app/build/outputs/apk/debug/app-debug.apk
+
+      - name: Upload AAB
+        uses: actions/upload-artifact@v4
+        with:
+          name: android-release-aab
+          path: android/app/build/outputs/bundle/release/app-release.aab