diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a0f4c41..8eb6b95 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -135,8 +135,11 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          signkey_path="$(mktemp)"
+          trap 'rm -f -- "$signkey_path"' EXIT
+          printf '%s' '${{ secrets.APK_SIGNKEY_B64 }}' | base64 -d > "$signkey_path"
           export APP_VERSION="$(git describe --tags --always --dirty)"
-          make apk
+          make apk SIGNKEY="$signkey_path" SIGNPASS='${{ secrets.APK_SIGNPASS }}'
           cp build/keepassgo.apk "${DIST_DIR}/keepassgo.apk"
 
       - name: Upload CI artifacts
diff --git a/Makefile b/Makefile
index bf460eb..a5056a8 100644
--- a/Makefile
+++ b/Makefile
@@ -9,6 +9,16 @@ APP_VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo
 GO_LDFLAGS ?= -X main.appVersion=$(APP_VERSION)
 ANDROID_MIN_SDK ?= 28
 ANDROID_TARGET_SDK ?= 35
+SIGNKEY ?=
+SIGNPASS ?=
+
+GOGIO_SIGN_FLAGS :=
+ifneq ($(strip $(SIGNKEY)),)
+GOGIO_SIGN_FLAGS += -signkey $(SIGNKEY)
+endif
+ifneq ($(strip $(SIGNPASS)),)
+GOGIO_SIGN_FLAGS += -signpass $(SIGNPASS)
+endif
 
 .PHONY: apk
 apk: android/keepassgo-android.jar
@@ -27,6 +37,7 @@ apk: android/keepassgo-android.jar
 		-buildmode exe \
 		-appid $(APP_ID) \
 		-ldflags "$(GO_LDFLAGS)" \
+		$(GOGIO_SIGN_FLAGS) \
 		-o $(APK_OUT) \
 		-version $(APK_VERSION) \
 		-minsdk $(ANDROID_MIN_SDK) \