diff --git a/CLAUDE.md b/CLAUDE.md
index 9419d2b..525312f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,6 +45,7 @@ The F-Droid build recipe lives at `fdroid/dev.debene.gopher.yml` (copied into `f
 - **`Builds[].commit` must be a full 40-char commit SHA**, not a `v*` tag or branch (reviewer requirement).
 - **`AutoName` must stay in the recipe** — `fdroid checkupdates` regenerates it from the manifest and that CI job fails on any resulting diff. (Only `Summary`/`Description` move to Fastlane; `AutoName` does not.)
 - **`AllowedAPKSigningKeys`** is the signing cert's SHA-256 (`apksigner verify --print-certs <signed.apk>`, colons stripped, lowercased) — it opts into Reproducible Builds so F-Droid verifies its build against our key instead of re-signing. One-way door; keep it.
+- **`Binaries`** is the URL pattern of our own signed release APK (`https://github.com/felipedbene/deburrow/releases/download/v%v/DeBurrow-v%v.apk`, `%v` = versionName). It's the reproducible-build *reference*: F-Droid downloads this developer-signed APK and byte-compares it against its own from-source build; combined with `AllowedAPKSigningKeys` this is what makes the build "verified reproducible". The `release.yml` workflow publishes exactly this asset name/path on each `v*` tag — keep the two in sync.
 - Keep `versionName`/`versionCode` in sync with `defaultConfig` in `app/build.gradle.kts` and tag releases as `v<versionName>` (e.g. `v2.0.3`). `UpdateCheckMode: Tags` + `AutoUpdateMode: Version` auto-detects new `v*` tags.
 - Validate locally before pushing: `fdroid rewritemeta <pkg>` (must produce no diff — canonical form), `fdroid lint <pkg>`, and `check-jsonschema --schemafile <fdroiddata>/schemas/metadata.json <recipe>`. Pin `ruamel.yaml<0.17.22` in the fdroidserver venv or `rewritemeta` reformats long values (e.g. wraps `AllowedAPKSigningKeys`) differently than CI.
 
diff --git a/fdroid/dev.debene.gopher.yml b/fdroid/dev.debene.gopher.yml
index ac209f4..0c6dc84 100644
--- a/fdroid/dev.debene.gopher.yml
+++ b/fdroid/dev.debene.gopher.yml
@@ -1,5 +1,5 @@
 Categories:
-  - Internet
+  - Browser
 License: MIT
 AuthorName: Felipe Debene
 WebSite: https://debene.dev
@@ -10,6 +10,7 @@ AutoName: DeBurrow
 
 RepoType: git
 Repo: https://github.com/felipedbene/deburrow.git
+Binaries: https://github.com/felipedbene/deburrow/releases/download/v%v/DeBurrow-v%v.apk
 
 Builds:
   - versionName: 2.0.3
@@ -19,7 +20,7 @@ Builds:
     gradle:
       - yes
 
-AllowedAPKSigningKeys: 10bfdeb0c04cc2cefff9e6c011205901d236bd1b8dd334fa908a21e89343262f
+AllowedAPKSigningKeys: 353db8b0a3c94c001eb71114b8640befa35e38760ee6c3ca4f301c7aedc5a1dd
 
 AutoUpdateMode: Version
 UpdateCheckMode: Tags