diff --git a/.gitignore b/.gitignore
index 713afae..0ab1392 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,6 @@ workspace.xml
 #   per-ABI OpenSSL statics from the toolchain image / fetch-openssl-statics.sh
 /app/src/main/jni/libiconv-1.17/
 /app/src/main/prebuild/
+
+# Signing secrets (never commit); see keystore.properties.sample.
+/keystore.properties
diff --git a/app/build.gradle b/app/build.gradle
index df91b42..e84d61a 100755
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -12,21 +12,49 @@ android {
     defaultConfig {
         applicationId "com.httrack.android"
         minSdk 24
-        // Left at master's value: 26 would silently drop the channel-less notifications,
-        // and 29 would take legacy storage away from the still File-based crawl.
-        targetSdk 25
-        versionCode 63
-        versionName "3.49.02.63"
+        // Play's upload floor. The behaviour changes crossed to here are handled: notification
+        // channels + POST_NOTIFICATIONS (#10), scoped storage (#11), predictive back (#12);
+        // edge-to-edge (35) is opted out in values-v35 until the layouts handle window insets.
+        targetSdk 35
+        // Must exceed the versionCode currently live on the Play listing before uploading.
+        versionCode 64
+        versionName "3.49.02.64"
 
         ndk {
             abiFilters "arm64-v8a", "x86_64"
         }
     }
 
+    // Release signing reads a gitignored keystore.properties (see keystore.properties.sample).
+    // Without it — e.g. on CI — the release stays unsigned, exactly as before.
+    signingConfigs {
+        release {
+            def propsFile = rootProject.file('keystore.properties')
+            if (propsFile.exists()) {
+                final Properties props = new Properties()
+                props.load(new FileInputStream(propsFile))
+                // Fail loudly on an incomplete file: a missing key otherwise yields a silently
+                // unsigned AAB (AGP skips signing when the config is not ready), which Play rejects.
+                ['storeFile', 'storePassword', 'keyAlias', 'keyPassword'].each { k ->
+                    if (!props.getProperty(k)?.trim()) {
+                        throw new GradleException("keystore.properties is missing '${k}'")
+                    }
+                }
+                storeFile rootProject.file(props.getProperty('storeFile'))
+                storePassword props.getProperty('storePassword')
+                keyAlias props.getProperty('keyAlias')
+                keyPassword props.getProperty('keyPassword')
+            }
+        }
+    }
+
     buildTypes {
         release {
             minifyEnabled false
             proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+            if (rootProject.file('keystore.properties').exists()) {
+                signingConfig signingConfigs.release
+            }
         }
     }
 
diff --git a/app/src/main/res/values-v35/styles.xml b/app/src/main/res/values-v35/styles.xml
new file mode 100644
index 0000000..980e631
--- /dev/null
+++ b/app/src/main/res/values-v35/styles.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <!-- targetSdk 35 forces edge-to-edge; opt out until the layouts handle window insets. -->
+    <style name="AppTheme" parent="AppBaseTheme">
+        <item name="android:windowOptOutEdgeToEdgeEnforcement">true</item>
+    </style>
+</resources>
diff --git a/keystore.properties.sample b/keystore.properties.sample
new file mode 100644
index 0000000..54cbf6c
--- /dev/null
+++ b/keystore.properties.sample
@@ -0,0 +1,6 @@
+# Copy to keystore.properties (gitignored) to sign a release APK / AAB for a Play upload.
+# Use the dedicated UPLOAD keystore (not the 2013 app-signing key). See the signing-key notes.
+storeFile=/absolute/path/to/httrack-upload.jks
+storePassword=CHANGEME
+keyAlias=upload
+keyPassword=CHANGEME