diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8e9bc93..7af63d1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,8 +49,8 @@ jobs:
       - name: Set up Android SDK
         uses: android-actions/setup-android@v4
 
-      - name: Build debug APK
-        run: ./gradlew assembleDebug --no-daemon --stacktrace
+      - name: Build release APK
+        run: ./gradlew assembleRelease --no-daemon --stacktrace
 
       - name: Stage APK for release
         id: stage
@@ -65,7 +65,7 @@ jobs:
           test -n "$offset"
           # Same arithmetic as build.gradle.kts, so the tag names the APK's own number.
           version="v${series}.$(( ${{ github.run_number }} + offset ))"
-          src="app/build/outputs/apk/debug/app-debug.apk"
+          src="app/build/outputs/apk/release/app-release.apk"
           dest="ProLibertateGames-${version}.apk"
           cp "$src" "$dest"
           # The same build again under a name that never changes. GitHub's
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 1e36084..8fa5615 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -104,6 +104,11 @@ android {
 
     buildTypes {
         release {
+            // Signed with the same key as the debug builds, so a release installs
+            // over what is already on a device; a different key would make the
+            // updater's installs fail with a signature mismatch.
+            signingConfig = signingConfigs.getByName("debug")
+            isDebuggable = false
             isMinifyEnabled = false
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),