diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml
new file mode 100644
index 00000000..888865cd
--- /dev/null
+++ b/.github/workflows/android-ci.yml
@@ -0,0 +1,88 @@
+name: Android CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: android-ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_VERSION: 24.19.0
+  PNPM_VERSION: 9.6.0
+  GRADLE_VERSION: 9.7.0
+
+jobs:
+  android:
+    name: Test and build Android
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install Java 17
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v4
+        with:
+          packages: >-
+            platform-tools
+            platforms;android-36
+            build-tools;36.1.0
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          gradle-version: ${{ env.GRADLE_VERSION }}
+          cache-provider: basic
+
+      - name: Install JavaScript dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build Capacitor web assets
+        run: pnpm --dir apps/client build
+
+      - name: Run Android tests and build Debug APK
+        run: gradle -p Android/project test lintDebug assembleDebug --no-daemon --stacktrace
+
+      - name: Upload Android test reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: android-test-reports
+          path: Android/project/**/build/{reports,test-results}/**
+          if-no-files-found: ignore
+
+      - name: Upload Debug APK
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: x-media-archive-debug-apk
+          path: Android/project/app/build/outputs/apk/debug/app-debug.apk
+          if-no-files-found: error
diff --git a/Android/README.md b/Android/README.md
index 1329ce64..50e5f4bc 100644
--- a/Android/README.md
+++ b/Android/README.md
@@ -67,6 +67,26 @@ Pop-Location
 
 Debug APK 位于 `Android/project/app/build/outputs/apk/debug/app-debug.apk`；发布产物应复制到 `Android/artifacts`，签名文件不得提交到仓库。
 
+## CI
+
+`.github/workflows/android-ci.yml` 是 Android 的完整 GitHub CI，会在 push 到 `main`、Pull Request 和手动触发时执行：
+
+- 构建 `apps/client` Web 资源
+- 运行 Android 单元测试
+- 运行 `lintDebug`
+- 构建并上传 Debug APK
+- 上传测试和 lint 报告
+
+GitHub Actions 会缓存 pnpm store、Gradle 依赖和 Gradle build cache。普通 CI 不执行 Release 签名构建；Release 构建需要配置签名密钥和密码，只应在受信任的发布流程中执行。
+
+本地快速检查可以只运行客户端构建和单元测试：
+
+```powershell
+. .\Android\env.ps1
+pnpm --dir apps/client build
+& .\Android\gradle\current\bin\gradle.bat -p Android/project test --no-daemon
+```
+
 ## 构建正式版
 
 正式版签名只从环境变量读取，密钥和密码不得写入仓库：