diff --git a/.gitignore b/.gitignore
index 2568565..3683c94 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,6 +27,8 @@ src-tauri/android/**/.gradle/
 *.jks
 *.keystore
 src-tauri/android/keystore.properties
+# The whole directory, so the password kept beside the key is covered too.
+android-keystore/
 
 # Editors / OS
 .DS_Store
diff --git a/scripts/local-keystore.sh b/scripts/local-keystore.sh
new file mode 100755
index 0000000..af0af4a
--- /dev/null
+++ b/scripts/local-keystore.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env sh
+# Point a local release build at the real signing key.
+#
+# app/build.gradle.kts reads rootProject/keystore.properties and, when it is
+# absent, leaves the release variant debug-signed rather than failing. CI writes
+# that file from secrets; this writes it from android-keystore/ so a local
+# `cargo tauri android build --apk` produces an APK signed with the same key a
+# release is, which is what makes a locally-built APK a valid update to an
+# installed one rather than a conflicting-signature install failure.
+#
+# gen/ is regenerated by `tauri android init`, which deletes this file. Re-run
+# after any init — it is cheap and idempotent.
+#
+# The keystore and its password live in android-keystore/, which is gitignored.
+set -e
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+KEYSTORE="$ROOT/android-keystore/bikecontrol-release.jks"
+PASSFILE="$ROOT/android-keystore/keystore-password.txt"
+DEST="$ROOT/src-tauri/gen/android/keystore.properties"
+
+[ -f "$KEYSTORE" ] || { echo "❌ no keystore at $KEYSTORE" >&2; exit 1; }
+[ -f "$PASSFILE" ] || { echo "❌ no password file at $PASSFILE" >&2; exit 1; }
+[ -d "$(dirname "$DEST")" ] || { echo "❌ no gen/android — run 'cargo tauri android init' first" >&2; exit 1; }
+
+# Absolute storeFile: gradle resolves a relative one against the app module dir,
+# not the root project.
+umask 077
+{
+  echo "storeFile=$KEYSTORE"
+  echo "storePassword=$(cat "$PASSFILE")"
+  echo "keyAlias=bikecontrol"
+  echo "keyPassword=$(cat "$PASSFILE")"
+} > "$DEST"
+
+echo "✅ wrote $DEST (storeFile=$KEYSTORE, keyAlias=bikecontrol)"