diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 03c6b1d..cb3f8e1 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -113,24 +113,31 @@ jobs:
             echo "::warning::ANDROID_KEYSTORE_BASE64 secret not set — falling back to a DEBUG apk (see CI-SETUP.md §5)"
           fi
 
-      - name: Build APK
+      - name: Build APK + AAB
         run: |
           VERSION=$(jq -r '.inputs.version' "$GITHUB_EVENT_PATH")
           cd app
           if [ -n "$ANDROID_KEYSTORE_FILE" ]; then
-            ./gradlew :androidApp:assembleRelease -PappVersion="$VERSION"
+            # APK for direct sideloading, AAB for Play Store uploads.
+            ./gradlew :androidApp:assembleRelease :androidApp:bundleRelease -PappVersion="$VERSION"
             cp androidApp/build/outputs/apk/release/androidApp-release.apk \
               "$GITHUB_WORKSPACE/iris-android-v$VERSION.apk"
+            cp androidApp/build/outputs/bundle/release/androidApp-release.aab \
+              "$GITHUB_WORKSPACE/iris-android-v$VERSION.aab"
           else
-            ./gradlew :androidApp:assembleDebug -PappVersion="$VERSION"
+            ./gradlew :androidApp:assembleDebug :androidApp:bundleDebug -PappVersion="$VERSION"
             cp androidApp/build/outputs/apk/debug/androidApp-debug.apk \
               "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.apk"
+            cp androidApp/build/outputs/bundle/debug/androidApp-debug.aab \
+              "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.aab"
           fi
 
       - uses: actions/upload-artifact@v4
         with:
           name: android
-          path: iris-android-*.apk
+          path: |
+            iris-android-*.apk
+            iris-android-*.aab
 
   desktop:
     name: Build desktop (Linux, jpackage)
@@ -217,4 +224,4 @@ jobs:
             curl -sf -X POST -H "$AUTH" -F "attachment=@$f" \
               "$API/releases/$RELEASE_ID/attachments" > /dev/null
           done
-          echo "Done: $SERVER/$REPO/releases/tag/$TAG"
\ No newline at end of file
+          echo "Done: $SERVER/$REPO/releases/tag/$TAG"
diff --git a/app/androidApp/build.gradle.kts b/app/androidApp/build.gradle.kts
index 5aa5b4d..e00e5e3 100644
--- a/app/androidApp/build.gradle.kts
+++ b/app/androidApp/build.gradle.kts
@@ -13,7 +13,9 @@ android {
         applicationId = "dev.iris.app"
         minSdk = 29
         targetSdk = 34
-        versionCode = 1
+        // Play Store requires an incrementing versionCode per upload; CI can
+        // pass -PappVersionCode=<n>. Local builds keep the default.
+        versionCode = (project.findProperty("appVersionCode")?.toString()?.toIntOrNull()) ?: 1
         // CI passes -PappVersion=<version> (release workflow); local builds
         // keep the default.
         versionName = (project.findProperty("appVersion") as? String) ?: "0.1.0"
@@ -80,4 +82,4 @@ dependencies {
 // inert and the ntfy listener is the push path.
 if (file("google-services.json").exists()) {
     apply(plugin = "com.google.gms.google-services")
-}
\ No newline at end of file
+}
diff --git a/scripts/make_release_keystore.sh b/scripts/make_release_keystore.sh
index ece19a4..36caf63 100755
--- a/scripts/make_release_keystore.sh
+++ b/scripts/make_release_keystore.sh
@@ -16,13 +16,14 @@ if [ -e "$OUT" ]; then
   exit 1
 fi
 
+# PKCS12 keystores do not support a separate key password (keytool ignores
+# -keypass), so one password covers both the store and the key.
 STORE_PASS="$(openssl rand -base64 18 | tr -d '/+=')"
-KEY_PASS="$(openssl rand -base64 18 | tr -d '/+=')"
 
 keytool -genkeypair -v \
   -keystore "$OUT" -storetype PKCS12 \
   -alias iris -keyalg RSA -keysize 2048 -validity 10000 \
-  -storepass "$STORE_PASS" -keypass "$KEY_PASS" \
+  -storepass "$STORE_PASS" \
   -dname "CN=Iris Release, OU=Mobile, O=Iris, C=DE"
 
 echo
@@ -35,4 +36,4 @@ echo "  ANDROID_KEYSTORE_BASE64   = $(base64 -w0 "$OUT")"
 echo
 echo "  ANDROID_KEYSTORE_PASSWORD = $STORE_PASS"
 echo "  ANDROID_KEY_ALIAS         = iris"
-echo "  ANDROID_KEY_PASSWORD      = $KEY_PASS"
\ No newline at end of file
+echo "  ANDROID_KEY_PASSWORD      = $STORE_PASS   # same: PKCS12 has no separate key password"