diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 585a71a..e862077 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -48,11 +48,14 @@ android {
 
     buildTypes {
         release {
-            isMinifyEnabled = false
+            isMinifyEnabled = true
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro",
             )
+            // Sign release builds with the debug key so they're installable for testing.
+            // A public release would configure a dedicated upload/release keystore here.
+            signingConfig = signingConfigs.getByName("debug")
         }
     }
 
diff --git a/app/proguard-rules.pro b/app/proguard-rules.pro
index dc533d7..105d796 100644
--- a/app/proguard-rules.pro
+++ b/app/proguard-rules.pro
@@ -1,14 +1,19 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
-# LibreMail ProGuard/R8 rules.
-#
-# Release builds are currently not minified (see app/build.gradle.kts). When
-# minification is enabled for release, add keep rules for the email/auth stack:
-#
-# Jakarta / Angus Mail (reflection-based provider registration):
-#   -keep class jakarta.mail.** { *; }
-#   -keep class org.eclipse.angus.mail.** { *; }
-#   -keep class com.sun.mail.** { *; }
-#   -dontwarn jakarta.activation.**
-#
-# AppAuth:
-#   -keep class net.openid.appauth.** { *; }
+# R8/ProGuard keep rules for LibreMail's release build.
+
+# --- Jakarta / Angus Mail (IMAP/SMTP) ---
+# Protocol providers (IMAP/SMTP stores and transports) are discovered via reflection and
+# META-INF service files, so keep the mail and activation classes and their members intact.
+-keep class jakarta.mail.** { *; }
+-keep class jakarta.activation.** { *; }
+-keep class org.eclipse.angus.mail.** { *; }
+-keep class org.eclipse.angus.activation.** { *; }
+-dontwarn jakarta.mail.**
+-dontwarn jakarta.activation.**
+-dontwarn org.eclipse.angus.**
+-dontwarn com.sun.activation.**
+
+# --- AppAuth ---
+# AppAuth (de)serializes its models (AuthState, token responses) reflectively.
+-keep class net.openid.appauth.** { *; }
+-dontwarn net.openid.appauth.**