diff --git a/.gitignore b/.gitignore
index cb40428..3b75e11 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,4 +6,7 @@ local.properties
 android-sdk/
 jdk/
 .tmp-android-build/
-.setup-build-environment.state
\ No newline at end of file
+.setup-build-environment.state
+keystore.properties
+*.keystore
+*.jks
\ No newline at end of file
diff --git a/SetupBuildEnvironment.sh b/SetupBuildEnvironment.sh
index 11e594b..7bec8c5 100755
--- a/SetupBuildEnvironment.sh
+++ b/SetupBuildEnvironment.sh
@@ -74,6 +74,13 @@ auto_commit_if_needed() {
 
   git -C "$PROJECT_DIR" add -A
 
+  # Defense in depth: never allow signing material or local signing config to be
+  # included in the automatic commit, even if a file was force-added manually.
+  git -C "$PROJECT_DIR" reset -q HEAD -- \
+    keystore.properties \
+    '*.keystore' \
+    '*.jks' 2>/dev/null || true
+
   if git -C "$PROJECT_DIR" diff --cached --quiet; then
     log "No source changes to commit after successful build"
     return
@@ -296,6 +303,12 @@ maybe_build() {
       artifact_source="$PROJECT_DIR/app/build/outputs/bundle/debug/app-debug.aab"
       artifact_target="$PROJECT_DIR/app/build/outputs/bundle/debug/githug-android-debug.aab"
       ;;
+    --build-release-aab)
+      gradle_task="bundleRelease"
+      artifact_label="release AAB"
+      artifact_source="$PROJECT_DIR/app/build/outputs/bundle/release/app-release.aab"
+      artifact_target="$PROJECT_DIR/app/build/outputs/bundle/release/githug-android-release.aab"
+      ;;
     *)
       return
       ;;
@@ -324,12 +337,13 @@ Usage: bash ./SetupBuildEnvironment.sh [--build | --build-aab]
 
   --build      Setup the environment and build the debug APK
   --build-aab  Setup the environment and build the debug Android App Bundle (AAB)
+  --build-release-aab  Setup the environment and build a release Android App Bundle (AAB)
 EOF_USAGE
 }
 
 validate_args() {
   case "${1:-}" in
-    ""|--build|--build-aab)
+    ""|--build|--build-aab|--build-release-aab)
       ;;
     *)
       echo "Unknown argument: $1" >&2
@@ -372,6 +386,7 @@ main() {
   log "To build without a background Gradle daemon: ./gradlew --no-daemon assembleDebug"
   log "To setup and build in one step: bash ./SetupBuildEnvironment.sh --build"
   log "To setup and build a debug AAB in one step: bash ./SetupBuildEnvironment.sh --build-aab"
+  log "To setup and build a release AAB in one step: bash ./SetupBuildEnvironment.sh --build-release-aab"
 }
 
 main "$@"
\ No newline at end of file
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 6da2f57..06aedd7 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -1,3 +1,11 @@
+import java.util.Properties
+
+val keystoreProperties = Properties()
+val keystorePropertiesFile = rootProject.file("keystore.properties")
+if (keystorePropertiesFile.exists()) {
+    keystorePropertiesFile.inputStream().use { keystoreProperties.load(it) }
+}
+
 plugins {
     id("com.android.application")
     id("org.jetbrains.kotlin.android")
@@ -11,16 +19,30 @@ android {
         applicationId = "solutions.tretter.githugandroid"
         minSdk = 26
         targetSdk = 34
-        versionCode = 82
-        versionName = "0.1.81"
+        versionCode = 83
+        versionName = "0.1.82"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         vectorDrawables.useSupportLibrary = true
     }
 
+    signingConfigs {
+        if (keystorePropertiesFile.exists()) {
+            create("release") {
+                storeFile = file(keystoreProperties.getProperty("storeFile"))
+                storePassword = keystoreProperties.getProperty("storePassword")
+                keyAlias = keystoreProperties.getProperty("keyAlias")
+                keyPassword = keystoreProperties.getProperty("keyPassword")
+            }
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = false
+            if (signingConfigs.findByName("release") != null) {
+                signingConfig = signingConfigs.getByName("release")
+            }
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro"
diff --git a/keystore.properties.example b/keystore.properties.example
new file mode 100644
index 0000000..78aad3c
--- /dev/null
+++ b/keystore.properties.example
@@ -0,0 +1,4 @@
+storeFile=/absolute/path/to/githug-upload.keystore
+storePassword=change-me
+keyAlias=githug-upload
+keyPassword=change-me
\ No newline at end of file