diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 6826be5..d3ec1d0 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -12,6 +12,9 @@ jobs:
     # Dedicated x86_64 runner (LXC op Proxmox) — de globale ARM64-runners hebben deze
     # label niet, dus zij pikken deze job niet op.
     runs-on: paperscan
+    # Laat het automatische Actions-token een release aanmaken + assets uploaden.
+    permissions:
+      contents: write
     # Image met Android SDK + JDK 17 + Gradle voorgeïnstalleerd.
     container:
       image: mingc/android-build-box:latest
@@ -41,8 +44,32 @@ jobs:
           SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
           SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
 
-      - name: Upload APK als artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: paperscan-release
-          path: app/build/outputs/apk/release/*.apk
+      - name: Publiceer release met APK als download
+        env:
+          TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+          API: ${{ github.api_url }}/repos/${{ github.repository }}
+        run: |
+          set -e
+          APK=$(ls app/build/outputs/apk/release/*.apk | head -1)
+          AUTH="Authorization: token $TOKEN"
+
+          # Hergebruik een bestaande release voor deze tag, of maak 'm aan.
+          REL_ID=$(curl -sS -H "$AUTH" "$API/releases/tags/$TAG" | grep -oP '"id":\s*\K[0-9]+' | head -1 || true)
+          if [ -z "$REL_ID" ]; then
+            REL_ID=$(curl -sS -X POST "$API/releases" -H "$AUTH" -H "Content-Type: application/json" \
+              -d "{\"tag_name\":\"$TAG\",\"name\":\"PaperScan $TAG\",\"body\":\"Automatische build van $TAG.\"}" \
+              | grep -oP '"id":\s*\K[0-9]+' | head -1)
+          fi
+          echo "Release id: $REL_ID"
+
+          # Verwijder een eventueel bestaande asset met dezelfde naam (bij re-run/hertag).
+          ASSET_NAME="paperscan-$TAG.apk"
+          OLD=$(curl -sS -H "$AUTH" "$API/releases/$REL_ID/assets" \
+            | grep -oP "\"id\":\s*\K[0-9]+(?=[^}]*\"name\":\s*\"$ASSET_NAME\")" | head -1 || true)
+          if [ -n "$OLD" ]; then curl -sS -X DELETE -H "$AUTH" "$API/releases/$REL_ID/assets/$OLD"; fi
+
+          # Upload de getekende APK als download-asset.
+          curl -sS -X POST "$API/releases/$REL_ID/assets?name=$ASSET_NAME" \
+            -H "$AUTH" -H "Content-Type: application/octet-stream" \
+            --data-binary @"$APK" | grep -oP '"browser_download_url":\s*"\K[^"]+' || true