diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 837a632..0eadd95 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -86,10 +86,16 @@ jobs:
       - name: Generate app icons
         run: dart run flutter_launcher_icons
 
+      - name: Decode Keystore
+        run: |
+          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > android/app/ci-keystore.jks
+          ls -la android/app/ci-keystore.jks
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+
       - name: Build APK (Release)
         run: flutter build apk --release --split-per-abi
         env:
-          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
           KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
           KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 03732d8..52c7814 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## [1.5.0-hotfix3] - 2026-01-02
+
+### Fixed
+- **App Signing**: Decode keystore in workflow before Gradle evaluation
+
 ## [1.5.0-hotfix2] - 2026-01-02
 
 ### Fixed
diff --git a/SpotiFLAC-v1.5.0-hotfix2-arm64.apk b/SpotiFLAC-v1.5.0-hotfix2-arm64.apk
new file mode 100644
index 0000000..0bfe020
Binary files /dev/null and b/SpotiFLAC-v1.5.0-hotfix2-arm64.apk differ
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 15409e4..99305d9 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -5,20 +5,15 @@ plugins {
     id("dev.flutter.flutter-gradle-plugin")
 }
 
-// Load keystore properties from file if exists
+// Load keystore properties from file if exists (local build)
 val keystorePropertiesFile = rootProject.file("keystore.properties")
 val keystoreProperties = java.util.Properties()
 if (keystorePropertiesFile.exists()) {
     keystoreProperties.load(java.io.FileInputStream(keystorePropertiesFile))
 }
 
-// Decode keystore from base64 if running in CI
-val ciKeystoreFile = file("${project.projectDir}/ci-keystore.jks")
-if (System.getenv("KEYSTORE_BASE64") != null && !ciKeystoreFile.exists()) {
-    ciKeystoreFile.writeBytes(
-        java.util.Base64.getDecoder().decode(System.getenv("KEYSTORE_BASE64"))
-    )
-}
+// CI keystore file (decoded by workflow)
+val ciKeystoreFile = file("ci-keystore.jks")
 
 android {
     namespace = "com.zarz.spotiflac"
@@ -46,7 +41,7 @@ android {
                 keyAlias = keystoreProperties["keyAlias"] as String
                 keyPassword = keystoreProperties["keyPassword"] as String
             } else if (ciKeystoreFile.exists()) {
-                // CI/CD build: use decoded keystore
+                // CI/CD build: use decoded keystore from workflow
                 storeFile = ciKeystoreFile
                 storePassword = System.getenv("KEYSTORE_PASSWORD")
                 keyAlias = System.getenv("KEY_ALIAS")
diff --git a/lib/constants/app_info.dart b/lib/constants/app_info.dart
index a9e53c9..5cb18e9 100644
--- a/lib/constants/app_info.dart
+++ b/lib/constants/app_info.dart
@@ -1,8 +1,8 @@
 /// App version and info constants
 /// Update version here only - all other files will reference this
 class AppInfo {
-  static const String version = '1.5.0-hotfix2';
-  static const String buildNumber = '16';
+  static const String version = '1.5.0-hotfix3';
+  static const String buildNumber = '17';
   static const String fullVersion = '$version+$buildNumber';
   
   static const String appName = 'SpotiFLAC';
diff --git a/pubspec.yaml b/pubspec.yaml
index 86fd2fb..8da1322 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -1,7 +1,7 @@
 name: spotiflac_android
 description: Download Spotify tracks in FLAC from Tidal, Qobuz & Amazon Music
 publish_to: 'none'
-version: 1.5.0+16
+version: 1.5.0+17
 
 environment:
   sdk: ^3.10.0