diff --git a/.github/workflows/apk.yml b/.github/workflows/apk.yml
new file mode 100644
index 0000000..d38628e
--- /dev/null
+++ b/.github/workflows/apk.yml
@@ -0,0 +1,82 @@
+name: APK build-and-release
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+jobs:
+  build-and-release:
+    name: Build and Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write   # needed for the release step
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0   # needed to fetch the ci branch below
+          fetch-tags: true
+
+      # - name: patch
+      #   run: |
+      #     git fetch origin revamp-ci
+      #     git checkout origin/ci -- app/build.gradle.kts
+      #     echo "PATCH DIFF:"
+      #     git diff -- app/build.gradle.kts
+
+      - name: Set up JDK
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Grant Permission to Execute
+        run: chmod +x gradlew
+
+      - name: Decode keystore
+        run: |
+          echo "${{ secrets.KEYSTORE }}" | base64 --decode > "$RUNNER_TEMP/release.keystore"
+
+      - name: Patch applicationId suffix to prevent collision with existing installs
+        run: |
+          perl -0777 -pi -e '
+            s/(release\s*\{\s*\n\s*isMinifyEnabled = true)/$1\n            applicationIdSuffix = ".revamp_v3"/
+          ' app/build.gradle.kts
+      
+          echo "--- patched block ---"
+          grep -A5 "release {" app/build.gradle.kts
+
+      - name: Build Release APK
+        env:
+          KEYSTORE: ${{ runner.temp }}/release.keystore
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
+        run: ./gradlew assembleRelease
+
+      - name: list artifacts
+        run: |
+          find . -iname '*.apk'
+
+      - name: Set TAG env var
+        run: |
+          RAW=$(git describe --tags --always --abbrev=0 2>/dev/null)
+          # CLEAN=$(echo "$RAW" | tr '/' '-' | tr '[:upper:]' '[:lower:]')
+          echo "TAG=$RAW" >> $GITHUB_ENV
+          echo "raw=$RAW" >> $GITHUB_OUTPUT
+
+      - name: Create GitHub Release
+        # if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v3
+        with:
+          name: ${{ env.TAG }}
+          tag_name: ${{ env.TAG }}
+          files: app/build/outputs/apk/release/*.apk
+          token: ${{ secrets.GITHUB_TOKEN }}
+          generate_release_notes: false
+          make_latest: true
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index f5cfd4b..a5f4131 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -28,8 +28,8 @@ android {
 	}
 	signingConfigs {
 		create("release") {
-			storeFile = file(System.getenv("KEYSTORE_FILE") ?: "keystore.jks")
-			storePassword = System.getenv("KEYSTORE_PASSWORD") ?: ""
+			storeFile = file(System.getenv("KEYSTORE") ?: "keystore.jks")
+			storePassword = System.getenv("STORE_PASSWORD") ?: ""
 			keyAlias = System.getenv("KEY_ALIAS") ?: ""
 			keyPassword = System.getenv("KEY_PASSWORD") ?: ""
 		}