diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 86b07d7..d07f977 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -45,6 +45,7 @@ jobs:
           command -v cmake >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: cmake not in PATH" >&2; exit 1; }
           [ -n "${QUESTSHOCK_BUILD_IMAGE:-}" ] || { echo "PREFLIGHT FAIL: QUESTSHOCK_BUILD_IMAGE not set - not running inside the questshock build-image?" >&2; exit 1; }
           [ -d /opt/prebuilt/built_sdl ] || { echo "PREFLIGHT FAIL: /opt/prebuilt/built_sdl missing" >&2; exit 1; }
+          [ -d /opt/prebuilt/android/gl4es ] || { echo "PREFLIGHT FAIL: /opt/prebuilt/android/gl4es missing - runner is using a build-image older than the Android/Quest layer" >&2; exit 1; }
 
       - name: Build package
         run: make package
@@ -57,8 +58,23 @@ jobs:
           name: questshock
           path: dist/questshock-*-linux-*.tar.gz
 
+      - name: Build Quest APK
+        # QUESTSHOCK_BUILD_IMAGE is already set (see Preflight above), so
+        # this runs build-apk.sh directly instead of trying to docker-run
+        # the image again - same reasoning as `make package` above.
+        # Unlike the fully offline engine/package build, this needs
+        # network access for Gradle/AGP's own dependency resolution - a
+        # scoped, accepted exception (see build-image/Dockerfile).
+        run: make apk
+
+      - name: Upload APK artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: questshock-quest-apk
+          path: dist/questshock-debug.apk
+
       - name: Publish to dl.ladkau.de
-        # Uploads the tarball over SFTP instead of using
+        # Uploads the tarball and APK over SFTP instead of using
         # actions/upload-artifact (whose zip wrapping can't be disabled).
         # Only runs on push so PR builds don't publish.
         if: gitea.event_name == 'push'
@@ -73,4 +89,5 @@ jobs:
             uploader@dl.ladkau.de <<EOF
           -mkdir files/questshock
           put $TARBALL files/questshock/$(basename "$TARBALL")
+          put dist/questshock-debug.apk files/questshock/questshock-debug.apk
           EOF