diff --git a/.forgejo/workflows/on_release.yml b/.forgejo/workflows/on_release.yml
new file mode 100644
index 00000000..a52796d9
--- /dev/null
+++ b/.forgejo/workflows/on_release.yml
@@ -0,0 +1,53 @@
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build_android:
+    runs-on: hetzner-access
+
+    steps:
+      - uses: https://source.mapcomplete.org/actions/checkout@v4
+      - uses: https://source.mapcomplete.org/actions/setup-android@v3.2.2
+
+      - name: Decode keystore
+        run: |
+          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > ./app/release-key.jks
+          pwd
+          echo "Saved release key to ./app/release-key.jks"
+
+      - name: Grant execute permission to gradlew
+        run: chmod +x ./gradlew
+
+      - name: Build signed APK
+        run: |
+          export ANDROID_SDK_HOME=/home/runner/.android/sdk/
+          export PATH=$ANDROID_SDK_HOME/tools:$ANDROID_SDK_HOME/platform-tools:$ANDROID_SDK_HOME/:$ANDROID_SDK_HOME/cmdline-tools/latest/tools/bin:$PATH
+          # Those variables are used in MapComplete/android/app/build.gradle
+          export storeFile="./release-key.jks"
+          export storePassword=${{ secrets.KEYSTORE_PASSWORD }}
+          export keyAlias=${{ secrets.KEY_ALIAS }}
+          export keyPassword=${{ secrets.KEY_PASSWORD }}
+          ./gradlew build
+          ./gradlew assembleRelease
+
+      - name: Upload APK to hetzner
+        shell: bash
+        run: |
+          TAG=$( echo ${{ env.GITHUB_REF_NAME }} )
+          scp app/build/outputs/apk/release/app-release.apk hetzner:~/public/apk/mapcomplete-$TAG.apk
+          ssh hetzner 'rm -f public/apk/mapcomplete-latest.apk && cp "public/apk/$(ls -v public/apk/ | tail -n 1)" public/apk/mapcomplete-latest.apk'
+
+      - name: Upload APK to forgejo releases (MapComplete)
+        uses: actions/forgejo-release@v2.6.0
+        with:
+          direction: upload
+          url: https://source.mapcomplete.org
+          repo: MapComplete/android-wrapper
+          release-dir: app/build/outputs/apk/release//
+          release-notes: "Release version ${{ github.ref_name }}"
+          sha: "${{ github.sha }}"
+          tag: "${{ github.ref_name }}"
+          token: ${{ secrets.WRITE_TOKEN }}