diff --git a/.github/actions/nix-devshell/action.yml b/.github/actions/nix-devshell/action.yml
new file mode 100644
index 0000000..d0f47b1
--- /dev/null
+++ b/.github/actions/nix-devshell/action.yml
@@ -0,0 +1,50 @@
+name: "nix-devshell"
+description:
+  "Set up Nix, prebuild the devshell and run commands inside the devshell."
+inputs:
+  prebuild:
+    description:
+      "Whether to prebuild the devshell (nix develop --command true)."
+    required: false
+    default: "false"
+  commands:
+    description:
+      "Commands to run inside the devshell (executed with bash -lc)."
+    required: false
+    default: ""
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install Nix (idempotent)
+      shell: bash
+      run: |
+        set -euo pipefail
+        if ! command -v nix >/dev/null 2>&1; then
+          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+        fi
+        # source the nix profile if present
+        if [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
+          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+        fi
+        nix --version
+
+    - name: Prebuild devshell
+      if: ${{ inputs.prebuild == 'true' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        if [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
+          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+        fi
+        nix --extra-experimental-features 'nix-command flakes' develop --command true
+
+    - name: Run commands in devshell
+      if: ${{ inputs.commands != '' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        if [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
+          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+        fi
+        nix --extra-experimental-features 'nix-command flakes' develop --command bash -lc "${{ inputs.commands }}"
diff --git a/.github/workflows/android.yaml b/.github/workflows/android.yaml
index 67afa0c..081a244 100644
--- a/.github/workflows/android.yaml
+++ b/.github/workflows/android.yaml
@@ -11,28 +11,60 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Install Nix (for nix usage)
-        run: |
-          set -euo pipefail
-          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
-          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
-          nix --version
-
       - name: Checkout code
         uses: actions/checkout@v6
 
-      - name: Collect Translation Files
-        run: |
-          set -euo pipefail
-          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
-          nix --version
-          cd lib/l10n
-          nix --extra-experimental-features 'nix-command flakes' develop --command python3 collect_translations.py
-          cd ../..
+      - name: Prepare Nix devshell
+        uses: ./.github/actions/nix-devshell
+        with:
+          prebuild: "true"
 
-      - name: Build Debug APK
-        run: |
-          set -euo pipefail
-          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
-          nix --version
-          nix --extra-experimental-features 'nix-command flakes' develop --command flutter build apk --debug
+      - name: Collect Translation Files
+        uses: ./.github/actions/nix-devshell
+        with:
+          commands: |
+            cd lib/l10n
+            python3 collect_translations.py
+
+      # - name: Build Debug APK
+      #   uses: ./.github/actions/nix-devshell
+      #   with:
+      #     commands: |
+      #       flutter build apk --debug --target-platform android-arm64
+
+      # - name: Upload APK artifact
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: app-debug-apk
+      #     path: build/app/outputs/flutter-apk/*.apk
+      #     # retention-days: 90
+
+      - name: Setup Release Keystore
+        uses: ./.github/actions/nix-devshell
+        with:
+          commands: |
+            # Write keystore and key.properties with absolute paths to ensure persistence across steps
+            echo "$RELEASE_KEYSTORE_BASE64" | base64 -d > $GITHUB_WORKSPACE/android/app/inventree-release-key.jks
+            chmod 600 $GITHUB_WORKSPACE/android/app/inventree-release-key.jks
+            printf "storePassword=%s\nkeyPassword=%s\nkeyAlias=%s\nstoreFile=%s\n" \
+              "$STORE_PASSWORD" "$KEY_PASSWORD" "$KEY_ALIAS" "$GITHUB_WORKSPACE/android/app/inventree-release-key.jks" \
+              > $GITHUB_WORKSPACE/android/key.properties
+            ls -la $GITHUB_WORKSPACE/android
+        env:
+          RELEASE_KEYSTORE_BASE64: ${{ secrets.INVENTREE_RELEASE_KEY_BASE64 }}
+          STORE_PASSWORD: ${{ secrets.INVENTREE_STORE_PASSWORD }}
+          KEY_PASSWORD: ${{ secrets.INVENTREE_KEY_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.INVENTREE_KEY_ALIAS }}
+
+      - name: Build Release APK
+        uses: ./.github/actions/nix-devshell
+        with:
+          commands: |
+            flutter build apk --release --no-tree-shake-icons
+
+      - name: Upload Release APK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: app-release-apk
+          path: build/app/outputs/flutter-apk/*.apk
+          # retention-days: 90