diff --git a/.forgejo/workflows/flutter.yml b/.forgejo/workflows/flutter.yml
index b677f62b..5f375e69 100644
--- a/.forgejo/workflows/flutter.yml
+++ b/.forgejo/workflows/flutter.yml
@@ -1,9 +1,13 @@
 name: flutter
 
-# Analyze + test + build the Flutter mobile client. Only runs when the
-# diff touches flutter_client/ or one of the shared web inputs the
-# sync_shared.sh script copies. Other pushes skip — this workflow is
-# independent from the Go/web test.yml and release.yml.
+# Analyze + test the Flutter mobile client; build an APK only where
+# it's actually consumed. dev pushes: analyze+test+codegen only
+# (~3min) — the operator dev-tests via a local Android Studio build,
+# not the CI artifact. main pushes: also build a debug APK as the
+# native-build safety net (Gradle/manifest/plugin breakage that
+# analyze+test can't catch) before any release tag. tags: signed
+# release APK. Only runs when the diff touches flutter_client/ or a
+# shared web input sync_shared.sh copies.
 
 on:
   push:
@@ -69,7 +73,9 @@ jobs:
         run: flutter test --reporter compact
 
       - name: Build debug APK
-        if: github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')
+        # main-only: native-build safety net before release tags.
+        # dev skips this (~7min) — operator dev-tests locally.
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: flutter build apk --debug
 
       - name: Decode signing keystore
@@ -112,7 +118,7 @@ jobs:
           flutter build apk --release --build-name="${TAG}"
 
       - name: Upload debug APK artifact
-        if: github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: forgejo/upload-artifact@v3
         with:
           name: minstrel-debug-${{ github.sha }}