diff --git a/.forgejo/workflows/android-apk.yml b/.forgejo/workflows/android-apk.yml
new file mode 100644
index 0000000..6994979
--- /dev/null
+++ b/.forgejo/workflows/android-apk.yml
@@ -0,0 +1,74 @@
+name: Forgejo Android APK
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    name: Build signed APK
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Set up Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: mobile/package-lock.json
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Install Capacitor dependencies
+        working-directory: mobile
+        run: |
+          npm install --no-audit --no-fund
+          npx cap sync android
+
+      - name: Restore signing keystore
+        env:
+          KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          test -n "$KEYSTORE_B64"
+          echo "$KEYSTORE_B64" | base64 -d > "$RUNNER_TEMP/pedscribe-release.jks"
+
+      - name: Build signed release APK
+        working-directory: mobile/android
+        env:
+          KS_PASS: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          KEY_PASS: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          ./gradlew assembleRelease \
+            -Pandroid.injected.signing.store.file="$RUNNER_TEMP/pedscribe-release.jks" \
+            -Pandroid.injected.signing.store.password="$KS_PASS" \
+            -Pandroid.injected.signing.key.alias="$KEY_ALIAS" \
+            -Pandroid.injected.signing.key.password="$KEY_PASS" \
+            --no-daemon --stacktrace
+
+      - name: Collect APK
+        run: |
+          mkdir -p artifacts
+          APK=$(find mobile/android/app/build/outputs/apk/release -name '*.apk' | head -1)
+          test -n "$APK"
+          cp "$APK" "artifacts/pedscribe-${GITHUB_REF_NAME:-manual}.apk"
+
+      - name: Upload APK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: pedscribe-android-apk
+          path: artifacts/*.apk
+          retention-days: 30
diff --git a/.forgejo/workflows/docker-build.yml b/.forgejo/workflows/docker-build.yml
new file mode 100644
index 0000000..ffa1313
--- /dev/null
+++ b/.forgejo/workflows/docker-build.yml
@@ -0,0 +1,41 @@
+name: Forgejo Docker Build
+
+on:
+  workflow_dispatch:
+    inputs:
+      push_image:
+        description: Push image to Forgejo container registry
+        required: false
+        default: 'true'
+
+jobs:
+  build:
+    name: Build Docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate Compose config
+        run: docker compose -f docker-compose.yml config >/tmp/ped-ai-compose.yml
+
+      - name: Build compose service
+        run: docker compose -f docker-compose.yml build pediatric-scribe
+
+      - name: Tag image
+        run: |
+          IMAGE="git.danvics.com/danvics/pediatric-ai-scribe-v3"
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          docker tag ped-ai-local:latest "$IMAGE:$SHORT_SHA"
+          docker tag ped-ai-local:latest "$IMAGE:latest"
+
+      - name: Push image to Forgejo registry
+        if: ${{ github.event.inputs.push_image != 'false' }}
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+        run: |
+          IMAGE="git.danvics.com/danvics/pediatric-ai-scribe-v3"
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "$FORGEJO_TOKEN" | docker login git.danvics.com -u danvics --password-stdin
+          docker push "$IMAGE:$SHORT_SHA"
+          docker push "$IMAGE:latest"
diff --git a/mobile/package-lock.json b/mobile/package-lock.json
index 8b5d7e4..c070883 100644
--- a/mobile/package-lock.json
+++ b/mobile/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "pedscribe-mobile",
-  "version": "1.0.0",
+  "version": "7.14.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pedscribe-mobile",
-      "version": "1.0.0",
+      "version": "7.14.0",
       "dependencies": {
         "@aparajita/capacitor-biometric-auth": "^8.0.0",
         "@capacitor/android": "^6.0.0",
@@ -20,7 +20,8 @@
         "@capacitor/screen-orientation": "^6.0.0",
         "@capacitor/share": "^6.0.0",
         "@capacitor/splash-screen": "^6.0.0",
-        "@capacitor/status-bar": "^6.0.0"
+        "@capacitor/status-bar": "^6.0.0",
+        "capacitor-secure-storage-plugin": "^0.10.0"
       }
     },
     "node_modules/@aparajita/capacitor-biometric-auth": {
@@ -488,6 +489,15 @@
         "node": "*"
       }
     },
+    "node_modules/capacitor-secure-storage-plugin": {
+      "version": "0.10.0",
+      "resolved": "https://registry.npmjs.org/capacitor-secure-storage-plugin/-/capacitor-secure-storage-plugin-0.10.0.tgz",
+      "integrity": "sha512-dV4E+HTZAJWC3gef7sBXaAkkb6wvcZHyXjJIHXNb3yz9gRQ/5VMLqCxa0khqpwgWh5oIbo4XFxg3g5tEkfaNMg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@capacitor/core": "^6.0.0"
+      }
+    },
     "node_modules/chownr": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
diff --git a/mobile/package.json b/mobile/package.json
index 7f4e2c3..16b69cc 100644
--- a/mobile/package.json
+++ b/mobile/package.json
@@ -23,7 +23,7 @@
     "@capacitor/share": "^6.0.0",
     "@capacitor/splash-screen": "^6.0.0",
     "@capacitor/status-bar": "^6.0.0",
-    "capacitor-native-biometric": "^5.0.0",
+    "@aparajita/capacitor-biometric-auth": "^8.0.0",
     "capacitor-secure-storage-plugin": "^0.10.0"
   }
 }