diff --git a/.circleci/config.yml b/.circleci/config.yml
index f699d294..9c7e2e20 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -58,6 +58,48 @@ jobs:
           command: |
             . ~/venv/bin/activate
             tx push -st
+  generate_signed_apk:
+    docker:
+      - image: circleci/android:api-27-alpha
+    working_directory: ~/ultrasonic
+    envoronment:
+      JAVA_TOOL_OPTIONS: "-XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap"
+    steps:
+      - checkout
+      - restore_cache:
+          key: gradle-cache-{{ checksum "dependencies.gradle" }}
+      - run:
+          name: decrypt ultrasonic-keystore
+          command: openssl aes-256-cbc -K ${ULTRASONIC_KEYSTORE_KEY} -iv ${ULTRASONIC_KEYSTORE_IV} -in ultrasonic-keystore.enc -out ultrasonic-keystore -d
+      - run:
+          name: build release apk
+          command: ./gradlew build assembleRelease
+      - run:
+          name: sign release apk
+          command: |
+            mkdir -p /tmp/ultrasonic-release
+            cd ultrasonic/build/outputs/apk/release/
+            for apk in *.apk; do
+              jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore ~/ultrasonic/ultrasonic-keystore -storepass ${ULTRASONIC_KEYSTORE_STOREPASS} -keypass ${ULTRASONIC_KEYSTORE_KEYPASS} ${apk} ultrasonic
+              jarsigner -verify ${apk}
+              ${ANDROID_HOME}/build-tools/27.0.0/zipalign -v 4 ${apk} /tmp/ultrasonic-release/${apk/-release/}
+            done
+      - persist_to_workspace:
+          root: /tmp/ultrasonic-release
+          paths:
+            - ultrasonic-*.apk
+  publish_github_signed_apk:
+    docker:
+      - image: circleci/golang
+    steps:
+      - attach_workspace:
+          at: /tmp/ultrasonic-release
+      - run:
+          name: install ghr
+          command: go get -v github.com/tcnksm/ghr
+      - run:
+          name: publish release on github tag
+          command: ghr -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} ${CIRCLE_TAG} /tmp/ultrasonic-release
 workflows:
   version: 2
   build_and_push_translations:
@@ -71,4 +113,18 @@ workflows:
               only:
                 - develop
                 - master
+      - generate_signed_apk:
+          filters:
+            tags:
+              only: /^[0-9]+(\.[0-9]+)*/
+            branches:
+              ignore: /.*/
+      - publish_github_signed_apk:
+          requires:
+            - generate_signed_apk
+          filters:
+            tags:
+              only: /^[0-9]+(\.[0-9]+)*/
+            branches:
+              ignore: /.*/
 
diff --git a/ultrasonic-keystore.enc b/ultrasonic-keystore.enc
new file mode 100644
index 00000000..3c818567
Binary files /dev/null and b/ultrasonic-keystore.enc differ