diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 24c4cf9..61b52b4 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -15,6 +15,24 @@ if (keystorePropertiesFile.exists()) {
     keystoreProperties.load(FileInputStream(keystorePropertiesFile))
 }
 
+fun resolveSigningValue(propertyKey: String, envKey: String): String? {
+    val envValue = System.getenv(envKey)?.takeIf { it.isNotBlank() }
+    if (envValue != null) {
+        return envValue
+    }
+    return (keystoreProperties[propertyKey] as? String)?.takeIf { it.isNotBlank() }
+}
+
+val releaseKeyAlias = resolveSigningValue("keyAlias", "ANDROID_KEY_ALIAS")
+val releaseKeyPassword = resolveSigningValue("keyPassword", "ANDROID_KEY_PASSWORD")
+val releaseStorePassword = resolveSigningValue("storePassword", "ANDROID_STORE_PASSWORD")
+val releaseStoreFilePath = resolveSigningValue("storeFile", "ANDROID_STORE_FILE")
+val hasReleaseSigning =
+    releaseKeyAlias != null &&
+    releaseKeyPassword != null &&
+    releaseStorePassword != null &&
+    releaseStoreFilePath != null
+
 android {
     namespace = "com.meshcore.sar.meshcore_sar_app"
     compileSdk = flutter.compileSdkVersion
@@ -49,19 +67,25 @@ android {
     }
 
     signingConfigs {
-        create("release") {
-            if (keystorePropertiesFile.exists()) {
-                keyAlias = keystoreProperties["keyAlias"] as String
-                keyPassword = keystoreProperties["keyPassword"] as String
-                storeFile = file(keystoreProperties["storeFile"] as String)
-                storePassword = keystoreProperties["storePassword"] as String
+        if (hasReleaseSigning) {
+            create("release") {
+                keyAlias = releaseKeyAlias
+                keyPassword = releaseKeyPassword
+                storeFile = file(releaseStoreFilePath!!)
+                storePassword = releaseStorePassword
             }
         }
     }
 
     buildTypes {
         release {
-            signingConfig = signingConfigs.getByName("release")
+            signingConfig =
+                if (hasReleaseSigning) {
+                    signingConfigs.getByName("release")
+                } else {
+                    // Keep CI release builds working even when private keystore isn't provided.
+                    signingConfigs.getByName("debug")
+                }
         }
     }
 }