diff --git a/.gitignore b/.gitignore
index e85754d9..dc469a13 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,9 @@ android/local.properties
 android/keystore
 android/keystore.asc
 android/keystore.properties
+# Signing keystores: the upload/app-signing keys must NEVER be committed
+*.jks
+android/*.jks
 android/*.apk
 android/*.apk.sha256
 android/*.AppImage
diff --git a/android/app/build.gradle b/android/app/build.gradle
index 47d0af00..4a61447c 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -46,6 +46,12 @@ android {
         release {
             minifyEnabled false
             proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+            // When android/keystore.properties exists the release build signs with
+            // the configured upload key; without it release stays unsigned and the
+            // build falls back to the debug-signed variant (see scripts/android.sh).
+            if (keystorePropertiesFile.exists()) {
+                signingConfig signingConfigs.release
+            }
         }
         if (keystorePropertiesFile.exists()) {
             signedRelease {