diff --git a/.gitea/workflows/build-and-test.yml b/.gitea/workflows/build-and-test.yml
index 509f3fc..8c8d17e 100644
--- a/.gitea/workflows/build-and-test.yml
+++ b/.gitea/workflows/build-and-test.yml
@@ -223,7 +223,8 @@ jobs:
           # It is also the honest artefact to check: the .so this names is the
           # one that ships in the APK, so the API level verified here is the
           # API level a device will refuse to install against.
-          cargo ndk -t arm64-v8a build -p darkroom-android --release
+          cargo ndk -t arm64-v8a -o target-android/jniLibs \
+            build -p darkroom-android --release
           MIN_API=$(sed -n 's/^ARG MIN_API=\([0-9]*\).*/\1/p' docker/android/Dockerfile)
           # Empty on both sides would compare equal and pass, so neither side
           # is allowed to be the result of a failed parse.
@@ -244,6 +245,41 @@ jobs:
             exit 1
           fi
 
+      # The APK itself, so a run leaves something installable behind rather
+      # than only the knowledge that it would have linked. The assembly is
+      # `docker/android/assemble-apk.sh`, shared with `package.sh` so the file
+      # a device gets from `package.sh --install` and the file published here
+      # are built by the same code — see that script's header.
+      #
+      # `KEYSTORE` deliberately points at a throwaway directory instead of its
+      # default under `target-android`: that directory is what `actions/cache`
+      # restores and saves, and a signing key has no business in a build cache
+      # or in anything this job uploads. A fresh debug key per run is the right
+      # trade for an artefact whose purpose is getting the app onto a test
+      # device; nothing upgrades in place over it, which is the one thing a
+      # stable key would buy.
+      - name: Package the APK
+        env:
+          CARGO_TARGET_DIR: target-android
+        run: |
+          set -e
+          KEYDIR="$(mktemp -d)"
+          trap 'rm -rf "$KEYDIR"' EXIT
+          REPO="$PWD" \
+          TARGET_DIR="$PWD/target-android" \
+          KEYSTORE="$KEYDIR/debug.keystore" \
+            bash docker/android/assemble-apk.sh
+
+      # `if-no-files-found: error` because the failure this guards against is
+      # a green run with an empty artefact list, which reads as success until
+      # somebody goes looking for the file.
+      - name: Upload the APK
+        uses: actions/upload-artifact@v4
+        with:
+          name: darkroom-arm64-v8a-apk
+          path: target-android/apk/darkroom.apk
+          if-no-files-found: error
+
   layering:
     runs-on: linux/amd64
     name: Layer separation