diff --git a/.gitea/workflows/apk-host.yaml b/.gitea/workflows/apk-host.yaml
index 8275aca..737e111 100644
--- a/.gitea/workflows/apk-host.yaml
+++ b/.gitea/workflows/apk-host.yaml
@@ -1,22 +1,38 @@
 name: Build Android
+
 on:
   push:
     tags: ['v*']
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to build and publish to its release (leave empty for a plain branch build)'
+        required: false
+        default: ''
 
 jobs:
   build:
-    runs-on: host
+    runs-on: self-hosted
     env:
       EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
       JAVA_HOME: ${{ vars.JAVA_HOME }}
       ANDROID_HOME: ${{ vars.ANDROID_HOME }}
       PATH: ${{ vars.NODE_BIN_DIR }}:${{ vars.JAVA_HOME }}/bin:${{ vars.ANDROID_HOME }}/cmdline-tools/latest/bin:${{ vars.ANDROID_HOME }}/platform-tools:/usr/local/bin:/usr/bin:/bin
     steps:
-      - uses: actions/checkout@v4
+      - name: Decide what we're building
+        id: meta
+        run: |
+          TAG=""
+          if [ -n "${{ inputs.tag }}" ]; then
+            TAG="${{ inputs.tag }}"
+          elif [ "${{ gitea.ref_type }}" = "tag" ]; then
+            TAG="${{ gitea.ref_name }}"
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-      - name: Verify toolchain
-        run: node -v && npm -v && java -version && javac -version && sdkmanager --version
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}   # empty = the triggering ref (tag push or selected branch)
 
       - name: Add google-services.json
         run: |
@@ -26,12 +42,48 @@ jobs:
           git add -A
           git -c user.name=ci -c user.email=ci@local commit -m "ci: add google-services.json"
 
+      - name: Verify toolchain
+        run: node -v && npm -v && java -version && javac -version && sdkmanager --version
+
       - run: npm ci
 
       - name: Build
         run: npx eas-cli build --profile release --local --platform android --non-interactive --output "$PWD/notifier.apk"
 
-      - uses: actions/upload-artifact@v3
+      # Manual branch build
+      - name: Upload artifact
+        if: steps.meta.outputs.tag == ''
+        uses: actions/upload-artifact@v3
         with:
-          name: notifier-apk
-          path: notifier.apk
\ No newline at end of file
+          name: notifier-${{ gitea.ref_name }}-${{ gitea.sha }}
+          path: notifier.apk
+
+      # Tag build
+      - name: Publish release
+        if: steps.meta.outputs.tag != ''
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          TAG: ${{ steps.meta.outputs.tag }}
+        run: |
+          set -euo pipefail
+          API="${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}"
+          AUTH="Authorization: token $RELEASE_TOKEN"
+          NAME="notifier-$TAG.apk"
+
+          RELEASE_ID=$(curl -s -H "$AUTH" "$API/releases/tags/$TAG" | jq -r '.id // empty')
+          if [ -z "$RELEASE_ID" ]; then
+            RELEASE_ID=$(curl -fsS -X POST "$API/releases" -H "$AUTH" \
+              -H "Content-Type: application/json" \
+              -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"Automated build of $TAG\"}" \
+              | jq -r .id)
+          fi
+
+          # on a re-run, replace the asset of the same name instead of failing
+          OLD_ID=$(curl -s -H "$AUTH" "$API/releases/$RELEASE_ID/assets" \
+            | jq -r --arg n "$NAME" '.[] | select(.name==$n) | .id')
+          if [ -n "$OLD_ID" ]; then
+            curl -fsS -X DELETE -H "$AUTH" "$API/releases/$RELEASE_ID/assets/$OLD_ID"
+          fi
+
+          curl -fsS -X POST "$API/releases/$RELEASE_ID/assets?name=$NAME" \
+            -H "$AUTH" -F "attachment=@notifier.apk"
\ No newline at end of file