diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 161c6867..4395cba2 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -2,15 +2,22 @@ pipeline:
   build:
     image: alvrme/alpine-android:android-33-jdk11
     commands:
-      - ./gradlew :app:assemble
+      - ./gradlew :app:assembleRelease
     when:
       path: [ app/**, build.gradle ]
+  sign:
+    image: alvrme/alpine-android:android-33-jdk11
+    commands:
+      - ./scripts/apk-sign.sh LemmInfinity-signed.apk app/build/outputs/apk/release/app-release-unsigned.apk
+    secrets: [ APK_KS_PASS, APK_KS, APK_KS_ALIAS ]
+    when:
+      event: [ tag ]
   publish:
     image: woodpeckerci/plugin-gitea-release
     settings:
       base_url: https://codeberg.org
       files:
-        - app/build/outputs/apk/release/app-release-unsigned.apk
+        - LemmInfinity-signed.apk
       api_key:
         from_secret: GITEA_ACCESS_TOKEN
       target: main
diff --git a/scripts/apk-sign.sh b/scripts/apk-sign.sh
new file mode 100755
index 00000000..916afbb9
--- /dev/null
+++ b/scripts/apk-sign.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+[ -z "${APK_KS_PASS}" ] && { echo "Missing keystore password (KS_PASS)"; exit 1; }
+[ -z "${APK_KS}" ] && { echo "Missing keystore file (KS)"; exit 1; }
+[ -z "${APK_KS_ALIAS}" ] && { echo "Missing keystore alias (KS_ALIAS)"; exit 1; }
+
+echo -n "$APK_KS" | base64 -d > /tmp/keystore.keystore
+
+apksigner sign --ks /tmp/keystore.keystore --ks-pass pass:${APK_KS_PASS} --ks-key-alias ${APK_KS_ALIAS} --out $1 $2
\ No newline at end of file