diff --git a/.github/android-signer/123235.json b/.github/android-signer/123235.json
index ee95fe0..8e6a26e 100644
--- a/.github/android-signer/123235.json
+++ b/.github/android-signer/123235.json
@@ -8,7 +8,7 @@
     "repository": "connectbot/actions",
     "repository_id": 1369420724,
     "sha256": [],
-    "workflow": ".github/workflows/android-build.yml"
+    "workflow": ".github/workflows/android-attest.yml"
   },
   "callers": {
     ".github/workflows/ci-tags.yml": [],
@@ -25,7 +25,7 @@
     "sha256": [],
     "workflow": ".github/workflows/android-finalize.yml"
   },
-  "policy_hash": "10fd32e04fe34e39762734fc69ca043381657bbc1b05a3883d40dadb5f239bb8",
+  "policy_hash": "52e5ee52950f2375caf6a6a958d09ca7b55d7cd90ca213aaffad15ee5c4a91ca",
   "profiles": {
     "google": {
       "hybrid_min_sdk": null,
@@ -63,7 +63,7 @@
   ],
   "repository": "connectbot/connectbot",
   "repository_id": 123235,
-  "revision": 1,
+  "revision": 2,
   "signer_revision": "39b8c5393a0e10285905f7ceb5aea73ffa54e870",
   "version": 2,
   "visibility": "public"
diff --git a/.github/android-signer/1421097317.json b/.github/android-signer/1421097317.json
index 1e5b030..fb99f60 100644
--- a/.github/android-signer/1421097317.json
+++ b/.github/android-signer/1421097317.json
@@ -8,7 +8,7 @@
     "repository": "connectbot/actions",
     "repository_id": 1369420724,
     "sha256": [],
-    "workflow": ".github/workflows/android-build.yml"
+    "workflow": ".github/workflows/android-attest.yml"
   },
   "callers": {
     ".github/workflows/ci.yml": []
@@ -24,7 +24,7 @@
     "sha256": [],
     "workflow": ".github/workflows/android-finalize.yml"
   },
-  "policy_hash": "b532a52d5b1f9536b5fd7377ed6107134f7859a71de4934d271e22d8c13daefd",
+  "policy_hash": "9fcc72e148625f3d26b299a5528b9d278382b7f18942ad81dc099852146bb968",
   "profiles": {
     "google": {
       "hybrid_min_sdk": null,
@@ -61,7 +61,7 @@
   ],
   "repository": "connectbot/test-signer-1",
   "repository_id": 1421097317,
-  "revision": 8,
+  "revision": 9,
   "signer_revision": "39b8c5393a0e10285905f7ceb5aea73ffa54e870",
   "version": 2,
   "visibility": "public"
diff --git a/.github/android-signer/README.md b/.github/android-signer/README.md
index 5f82724..84fea3a 100644
--- a/.github/android-signer/README.md
+++ b/.github/android-signer/README.md
@@ -10,7 +10,8 @@ Trusted workflows in `connectbot/actions` read this repository (immutable ID
 file and record the policy commit and digest in final provenance. Source builds
 cannot replace this policy through workflow inputs or source checkout contents.
 
-The builder and finalizer run from protected `android-signer-v1` in
+The attestor (`android-attest.yml`) and finalizer run from protected
+`android-signer-v1` in
 `connectbot/actions` (immutable ID 1369420724). Caller workflow paths identify
 eligible CI entry points; empty digest lists intentionally mean identity-based
 authorization. Exact executed workflow commits remain recorded in certificates,
@@ -23,3 +24,8 @@ provisioning. Export policies with the appliance's offline admin tool after key,
 certificate and lineage validation; do not hand-edit fingerprints or policy hashes.
 The test repository policy uses disposable keys. Its workflow cannot publish to
 Google Play; production Play access is scoped to repository ID 123235 and alpha.
+
+Application build instructions stay in each source repository. The shared
+attestor verifies a stable artifact handoff without executing application code.
+Changing Java, Gradle tasks, flavors, or output paths within that contract does
+not require an update to these policies.