diff --git a/.gitea/workflows/beta.yml b/.gitea/workflows/beta.yml
new file mode 100644
index 0000000..d406ee9
--- /dev/null
+++ b/.gitea/workflows/beta.yml
@@ -0,0 +1,68 @@
+name: Beta (TestFlight)
+
+on:
+  push:
+    branches:
+      - develop
+
+jobs:
+  wake-macos-vm:
+    runs-on: macos-ctl
+    steps:
+      - name: Start macOS VM container
+        run: docker start macos
+
+  build-and-upload:
+    needs: wake-macos-vm
+    runs-on: macos-release
+
+    env:
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
+      DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
+      BUILD_NUMBER: ${{ gitea.run_number }}
+
+    steps:
+      - name: Checkout
+        run: |
+          export GIT_TERMINAL_PROMPT=0
+          export GIT_ASKPASS=/bin/false
+          export SSH_ASKPASS=/bin/false
+          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
+          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
+          git checkout "${{ gitea.sha }}"
+
+      - name: Write App Store Connect API key
+        run: |
+          cat > Darwin/fastlane/apikey.json <<EOF
+          {
+            "key_id": "${{ secrets.ASC_KEY_ID }}",
+            "issuer_id": "${{ secrets.ASC_ISSUER_ID }}",
+            "key": "${{ secrets.ASC_KEY_CONTENT }}",
+            "is_key_content_base64": true,
+            "duration": 1200,
+            "in_house": false
+          }
+          EOF
+
+      - name: Unlock keychain and run fastlane beta
+        run: |
+          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-signing.keychain-db
+          security list-keychains -d user -s ~/Library/Keychains/ci-signing.keychain-db ~/Library/Keychains/login.keychain-db
+          security default-keychain -d user -s ~/Library/Keychains/ci-signing.keychain-db
+          security find-identity -v -p codesigning
+          cd Darwin
+          fastlane beta
+
+      - name: Clean up API key
+        if: always()
+        run: rm -f Darwin/fastlane/apikey.json
+
+  sleep-macos-vm:
+    needs: build-and-upload
+    if: always()
+    runs-on: macos-ctl
+    steps:
+      - name: Stop macOS VM container
+        run: docker stop macos
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..6277d81
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,86 @@
+name: Release (App Store Connect)
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  wake-macos-vm:
+    runs-on: macos-ctl
+    steps:
+      - name: Start macOS VM container
+        run: docker start macos
+
+  build-archive-deliver:
+    needs: wake-macos-vm
+    runs-on: macos-release
+
+    env:
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
+      DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
+      BUILD_NUMBER: ${{ gitea.run_number }}
+
+    steps:
+      - name: Checkout
+        run: |
+          export GIT_TERMINAL_PROMPT=0
+          export GIT_ASKPASS=/bin/false
+          export SSH_ASKPASS=/bin/false
+          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
+          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
+          git checkout "${{ gitea.sha }}"
+
+      - name: Verify ASC secrets
+        run: |
+          if [ -z "${{ secrets.ASC_KEY_ID }}" ]; then
+            echo "ERROR: ASC_KEY_ID is empty"
+            exit 1
+          fi
+
+      - name: Write App Store Connect API key
+        run: |
+          cat > Darwin/fastlane/apikey.json <<EOF
+          {
+            "key_id": "${{ secrets.ASC_KEY_ID }}",
+            "issuer_id": "${{ secrets.ASC_ISSUER_ID }}",
+            "key": "${{ secrets.ASC_KEY_CONTENT }}",
+            "is_key_content_base64": true,
+            "duration": 1200,
+            "in_house": false
+          }
+          EOF
+
+      - name: Unlock keychain and run fastlane release
+        run: |
+          echo "whoami: $(whoami)"
+          echo "HOME: $HOME"
+          echo "expanded keychain path: $HOME/Library/Keychains/ci-signing.keychain-db"
+          ls -la "$HOME/Library/Keychains/" || echo "cannot list Keychains dir"
+          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" "$HOME/Library/Keychains/ci-signing.keychain-db"
+          echo "--- keychain info ---"
+          security show-keychain-info "$HOME/Library/Keychains/ci-signing.keychain-db" || true
+          security list-keychains -d user -s "$HOME/Library/Keychains/ci-signing.keychain-db" "$HOME/Library/Keychains/login.keychain-db"
+          security default-keychain -d user -s "$HOME/Library/Keychains/ci-signing.keychain-db"
+          echo "--- current search list ---"
+          security list-keychains
+          echo "--- dump-keychain identity count ---"
+          security dump-keychain "$HOME/Library/Keychains/ci-signing.keychain-db" | grep -c "class.*0x80001000" || true
+          echo "--- find-identity ---"
+          security find-identity -v -p codesigning
+          cd Darwin
+          fastlane release
+
+      - name: Clean up API key
+        if: always()
+        run: rm -f Darwin/fastlane/apikey.json
+
+  sleep-macos-vm:
+    needs: build-archive-deliver
+    if: always()
+    runs-on: macos-ctl
+    steps:
+      - name: Stop macOS VM container
+        run: docker stop macos
diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
new file mode 100644
index 0000000..9e1f4e1
--- /dev/null
+++ b/.gitea/workflows/test.yml
@@ -0,0 +1,43 @@
+name: Test (feature branches)
+
+on:
+  pull_request:
+    branches:
+      - "feature/*"
+
+jobs:
+  wake-macos-vm:
+    runs-on: macos-ctl
+    steps:
+      - name: Start macOS VM container
+        run: docker start macos
+
+  test:
+    needs: wake-macos-vm
+    runs-on: macos-release
+
+    steps:
+      - name: Checkout
+        run: |
+          export GIT_TERMINAL_PROMPT=0
+          export GIT_ASKPASS=/bin/false
+          export SSH_ASKPASS=/bin/false
+          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
+          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
+          git checkout "${{ gitea.sha }}"
+
+      - name: Run unit tests
+        run: |
+          xcodebuild test \
+            -project Darwin/PediFoods.xcodeproj \
+            -scheme "PediFoods App" \
+            -destination "platform=iOS Simulator,name=iPhone 16,OS=latest"
+
+  sleep-macos-vm:
+    needs: test
+    if: always()
+    runs-on: macos-ctl
+    steps:
+      - name: Stop macOS VM container
+        run: docker stop macos
diff --git a/Darwin/PediFoods.xcodeproj/project.pbxproj b/Darwin/PediFoods.xcodeproj/project.pbxproj
index 260be95..9a9e402 100644
--- a/Darwin/PediFoods.xcodeproj/project.pbxproj
+++ b/Darwin/PediFoods.xcodeproj/project.pbxproj
@@ -196,6 +196,8 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 496EB72F2A6AE4DE00C1253B /* PediFoods.xcconfig */;
 			buildSettings = {
+				CODE_SIGN_IDENTITY = "Apple Distribution";
+				CODE_SIGN_STYLE = Manual;
 				DEVELOPMENT_TEAM = K4E5BZMM4V;
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_KEY_CFBundleDisplayName = "Pedi Foods";
@@ -204,6 +206,7 @@
 				INFOPLIST_KEY_UISupportedInterfaceOrientations = UIInterfaceOrientationPortrait;
 				LD_RUNPATH_SEARCH_PATHS = "@executable_path/Frameworks";
 				"LD_RUNPATH_SEARCH_PATHS[sdk=macosx*]" = "@executable_path/../Frameworks";
+				PROVISIONING_PROFILE_SPECIFIER = "com.br.pedifoods.app AppStore";
 				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
 				SUPPORTS_MACCATALYST = NO;
 				TARGETED_DEVICE_FAMILY = 1;
diff --git a/Darwin/fastlane/Fastfile b/Darwin/fastlane/Fastfile
index cfc6f8f..6fda24a 100644
--- a/Darwin/fastlane/Fastfile
+++ b/Darwin/fastlane/Fastfile
@@ -7,12 +7,27 @@ default_platform(:ios)
 lane :assemble do |options|
   # only build the iOS side of the app
   ENV["SKIP_ZERO"] = "true"
+
+  # Manual signing (team/identity/profile) for the "PediFoods App" target is
+  # baked directly into PediFoods.xcodeproj's own project settings - not
+  # overridden here. A command-line xcargs/update_code_signing_settings
+  # override applies to the entire build graph, including the SPM package's
+  # own ephemeral targets (PediFoods, pedi-foods_PediFoods) which explicitly
+  # reject provisioning profiles and must stay Automatic; there's no way to
+  # scope a global override to just one target, and update_code_signing_settings
+  # itself can't parse this project's newer .pbxproj format anyway (gem
+  # limitation, not fixable by updating the gem).
+  # agvtool needs VERSIONING_SYSTEM = apple-generic, which this project doesn't
+  # set, so it silently no-ops - pass CURRENT_PROJECT_VERSION directly instead.
+  xcargs = "-skipPackagePluginValidation -skipMacroValidation"
+  xcargs += " CURRENT_PROJECT_VERSION=#{ENV['BUILD_NUMBER']}" if ENV["BUILD_NUMBER"]
+
   build_app(
     scheme: "PediFoods App",
     sdk: "iphoneos",
     export_method: ENV["BITRISE_DISTRIBUTION_METHOD"] || "app-store",
     xcconfig: "fastlane/AppStore.xcconfig",
-    xcargs: "-skipPackagePluginValidation -skipMacroValidation",
+    xcargs: xcargs,
     derived_data_path: "../.build/Darwin/DerivedData",
     output_directory: "../.build/fastlane/Darwin",
     skip_archive: ENV["FASTLANE_SKIP_ARCHIVE"] == "YES",
@@ -48,7 +63,8 @@ lane :release do |options|
   upload_to_app_store(
     api_key_path: "fastlane/apikey.json",
     app_rating_config_path: "fastlane/metadata/rating.json",
-    release_notes: { default: "Fixes and improvements." }
+    release_notes: { default: "Fixes and improvements." },
+    submit_for_review: false
   )
 end