diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 405bda4..f956269 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -249,6 +249,7 @@ jobs:
           "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
             --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
             --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
+            --alignment-preserved true \
             --out "$out" "$f"
           # Prove the signer cert matches AllowedAPKSigningKeys.
           "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
@@ -375,6 +376,7 @@ jobs:
           "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
             --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
             --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
+            --alignment-preserved true \
             --out "$out" "$f"
           "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
           rm -f /tmp/ks.jks
@@ -499,6 +501,7 @@ jobs:
           "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
             --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
             --v1-signing-enabled false --v2-signing-enabled true --v3-signing-enabled true \
+            --alignment-preserved true \
             --out "$out" "$f"
           "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
           rm -f /tmp/ks.jks