diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b4e8c49..a60ec99 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
       - "v*"
       - "release-*"
       - "[0-9]+.[0-9]+.[0-9]+*"
+  pull_request:
+    branches:
+      - main
 
 permissions:
   contents: write
@@ -16,7 +19,6 @@ env:
   GO_VERSION: "1.26.1"
   ANDROID_SDK_ROOT: /opt/android-sdk
   ANDROID_NDK_ROOT: /opt/android-sdk/ndk
-  JAVA_HOME: /usr/lib/jvm/java-21-openjdk-amd64
   DIST_DIR: dist
 
 jobs:
@@ -31,6 +33,12 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
 
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "25"
+
       - name: Install native build dependencies
         shell: bash
         run: |
@@ -78,6 +86,12 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
 
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "25"
+
       - name: Install native build dependencies
         shell: bash
         run: |
diff --git a/AGENTS.md b/AGENTS.md
index 4925d1d..17557af 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -177,7 +177,7 @@ These features are product requirements, not “nice to have” ideas.
   local `ANDROID_NDK_ROOT=/opt/android-ndk`,
   CI `ANDROID_NDK_ROOT=/opt/android-sdk/ndk`,
   local `JAVA_HOME=/usr/lib/jvm/java-25-openjdk`,
-  CI `JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64`.
+  CI `JAVA_HOME` provided by `actions/setup-java` with Temurin 25.
 - Remember the known Android runtime regression:
   `gioui.org v0.9.0` produced a black screen on the `KeepassGoAPI35` emulator, while `gioui.org v0.8.0` rendered correctly. Treat Gio upgrades on Android as regression-sensitive and verify them on-device or in the emulator.
 - When validating an APK in the emulator, prefer the known KeePassGO setup:
diff --git a/APK.md b/APK.md
index af93d30..aa0642e 100644
--- a/APK.md
+++ b/APK.md
@@ -15,7 +15,8 @@ make apk-release
 `make apk` uses a local Java 25 install when `JAVA_HOME` points to one.
 If the host does not have a working Java 25 install, it falls back to the
 repo-managed Docker image in `packaging/docker/android-apk/`, which also builds
-with Java 25.
+with Java 25. CI provisions Java 25 directly in the build job so release builds
+use that same local path instead of nested Docker.
 
 `make apk` remains a developer build path and may use Gio's default debug or
 ephemeral signing behavior if no explicit signing key is provided.
@@ -67,7 +68,7 @@ The Android build uses the branded icon asset at:
 
 Note:
 
-- KeePassGO's documented Android build uses Java 25 locally.
+- KeePassGO's documented Android build uses Java 25 locally and in CI.
 - If that host setup is unavailable, `make apk` falls back to the Docker image
   so the build still runs under Java 25 instead of encoding a newer host JDK as
   a requirement.
diff --git a/Makefile b/Makefile
index eba6520..2c29c83 100644
--- a/Makefile
+++ b/Makefile
@@ -86,7 +86,7 @@ apk-local: android/keepassgo-android.jar
 apk-release:
 	@test -f "$(RELEASE_SIGNKEY)" || { echo "Release signing key not found at $(RELEASE_SIGNKEY)"; exit 1; }
 	@test -f "$(RELEASE_SIGNPASS_FILE)" || { echo "Release signing password file not found at $(RELEASE_SIGNPASS_FILE)"; exit 1; }
-	@$(MAKE) apk SIGNKEY="$(abspath $(RELEASE_SIGNKEY))" SIGNPASS_FILE="$(abspath $(RELEASE_SIGNPASS_FILE))"
+	@$(MAKE) apk SIGNKEY="$(abspath $(RELEASE_SIGNKEY))" SIGNPASS_FILE="$(abspath $(RELEASE_SIGNPASS_FILE))" JAVA_HOME="$(JAVA_HOME)"
 
 apk-container: apk-container-image
 	@command -v docker >/dev/null 2>&1 || { echo "docker is required for apk-container"; exit 1; }
diff --git a/README.md b/README.md
index fb720d3..cb24e6d 100644
--- a/README.md
+++ b/README.md
@@ -95,8 +95,9 @@ make apk
 
 `make apk` prefers a local Java 25 install at `JAVA_HOME`. If that is not
 available, it falls back to the repo-managed Docker build image, which also
-uses Java 25. You still need the Android SDK and NDK installed and configured
-for real device or release packaging.
+uses Java 25. CI provisions Java 25 directly in the build job so release
+packaging follows that same local path. You still need the Android SDK and NDK
+installed and configured for real device or release packaging.
 
 Release package: