diff --git a/ci/version.sh b/ci/version.sh
index 36583f45..72d115df 100755
--- a/ci/version.sh
+++ b/ci/version.sh
@@ -65,6 +65,19 @@ if [ "${code}" -le 0 ]; then
   exit 1
 fi
 
+# Android's versionCode is a signed 32-bit int and the platform refuses an APK
+# whose code exceeds it. At ~525k minutes a year this is four thousand years
+# away in normal operation, so the realistic cause is a build machine with a
+# badly wrong clock — which produces a code that is not merely too large but
+# also unreachably high, permanently blocking every real build that follows
+# from ever outranking it. Cheaper to refuse the build than to discover that
+# from a phone that will not update.
+readonly VERSION_CODE_CEILING=2147483647
+if [ "${code}" -gt "${VERSION_CODE_CEILING}" ]; then
+  echo "version.sh: ordering key '${code}' exceeds versionCode's int32 ceiling — build clock wrong?" >&2
+  exit 1
+fi
+
 # KEY=VALUE, which is also exactly $GITHUB_OUTPUT's format.
 echo "name=${name}"
 echo "code=${code}"