diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 42dc67d..dc21c31 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -23,6 +23,29 @@ jobs:
       - name: Set up Android SDK
         uses: android-actions/setup-android@v3
 
+      # Signing material is injected at build time from Gitea Actions secrets — never
+      # committed. build.gradle.kts reads app/keystore.properties, so recreate it here.
+      - name: Decode signing keystore
+        run: |
+          if [ -z "${{ secrets.KEYSTORE_BASE64 }}" ]; then
+            echo "::error::KEYSTORE_BASE64 secret is not set — cannot build a signed release."
+            exit 1
+          fi
+          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > app/homelab-mfa-release.keystore
+
+      - name: Write signing credentials
+        run: |
+          if [ -z "${{ secrets.KEYSTORE_PASSWORD }}" ] || [ -z "${{ secrets.KEY_PASSWORD }}" ]; then
+            echo "::error::KEYSTORE_PASSWORD / KEY_PASSWORD secrets not set — cannot sign release."
+            exit 1
+          fi
+          {
+            echo "storeFile=homelab-mfa-release.keystore"
+            echo "storePassword=${{ secrets.KEYSTORE_PASSWORD }}"
+            echo "keyPassword=${{ secrets.KEY_PASSWORD }}"
+            echo "keyAlias=${{ secrets.KEY_ALIAS || 'homelab-mfa' }}"
+          } > app/keystore.properties
+
       - name: Build release APK
         run: |
           chmod +x ./gradlew
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 28ba754..e3e072e 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -19,8 +19,8 @@ android {
         applicationId = "me.khodak.mfa"
         minSdk = 28
         targetSdk = 34
-        versionCode = 3
-        versionName = "1.2"
+        versionCode = 4
+        versionName = "1.3"
     }
 
     val hasReleaseSigning = keystoreProps.getProperty("storePassword") != null