diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 393c5ca..e12a3fe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,10 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   release:
     name: Build and Release APK
@@ -18,17 +22,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Fetch all history for proper versioning
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '17'
 
+      - name: Setup Gradle Build Cache
+        uses: gradle/actions/setup-gradle@v6
+
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
@@ -39,7 +46,19 @@ jobs:
 
       - name: Install dependencies
         working-directory: ./workout-logger
-        run: flutter pub get
+        run: |
+          flutter pub get
+          : "${PUB_CACHE:?PUB_CACHE is not set}"
+          mapfile -t targets < <(find "$PUB_CACHE" -type f -path '*/jni-*/src/CMakeLists.txt')
+          if [ "${#targets[@]}" -eq 0 ]; then
+            echo "Error: no jni-*/src/CMakeLists.txt files found under \$PUB_CACHE" >&2
+            exit 1
+          fi
+          for f in "${targets[@]}"; do
+            if ! grep -q -- '-Wl,--build-id=none' "$f"; then
+              sed -i -e 's/-Wl,/-Wl,--build-id=none,/' "$f"
+            fi
+          done
 
       - name: Bump version
         if: github.event_name == 'push'
@@ -117,6 +136,10 @@ jobs:
 
       - name: Decode release keystore
         run: |
+          if [ -z "${{ secrets.KEYSTORE_BASE64 }}" ]; then
+            echo "Error: KEYSTORE_BASE64 secret is not configured in repository secrets."
+            exit 1
+          fi
           echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > /tmp/repforge-release.jks
 
       - name: Build APK
@@ -126,7 +149,7 @@ jobs:
           KEY_STORE_PASSWORD: ${{ secrets.KEY_STORE_PASSWORD }}
           KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-        run: flutter build apk --release --split-per-abi
+        run: flutter build apk --release --split-per-abi --obfuscate --split-debug-info=build/app/outputs/symbols
 
       - name: Rename APKs
         run: |
@@ -150,7 +173,7 @@ jobs:
 
       - name: Create GitHub Release
         if: github.event_name == 'push' && steps.commit_version.outputs.committed == 'true'
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ steps.version.outputs.value }}
           name: RepForge v${{ steps.version.outputs.value }}