diff --git a/infra/README.md b/infra/README.md
index 4d6cda7..6baf261 100644
--- a/infra/README.md
+++ b/infra/README.md
@@ -278,7 +278,9 @@ HTTP to the registry.
 ### Publishing an APK: `infra/publish-apk.sh`
 
 Version rule (SPEC §10.6): `version_code` = `git rev-list --count HEAD`, `version_name` = `YYYY.MM.DD-<short sha>`
-of HEAD's commit date (Europe/Stockholm), passed as `-Pkvitt.versionCode` and `-Pkvitt.versionName`. The image
+of HEAD's commit date (Europe/Stockholm), passed as `-Pkvitt.versionCode` and `-Pkvitt.versionName`; the script
+reads `KVITT_PUBLIC_HOST` from `infra/pi/.env` (refusing a missing file or key or a `CHANGE_ME` value) and passes it as
+`-Pkvitt.publicHost`, the app's release server and invite-link host (D-121). The image
 tags of the Gitea workflow (`v1.0.N`) are separate and say nothing about the APK. The script refuses a dirty tree,
 builds `:app:assembleRelease` through `tools/gradle-serial.sh` (JDK 25 on `PATH`), refuses an unsigned APK, and
 writes into `infra/pi/out/apk/`: `kvitt-<version_code>.apk`, `kvitt-<version_code>.mapping.txt` (the R8 mapping,
diff --git a/infra/publish-apk.sh b/infra/publish-apk.sh
index b4438b0..eb6f680 100755
--- a/infra/publish-apk.sh
+++ b/infra/publish-apk.sh
@@ -4,10 +4,12 @@
 #  1. refuses a dirty working tree (the version is derived from HEAD)
 #  2. version (SPEC §10.6): version_code = `git rev-list --count HEAD`, version_name = YYYY.MM.DD-<short sha> of
 #     HEAD's commit date (Europe/Stockholm), passed as -Pkvitt.versionCode / -Pkvitt.versionName
-#  3. :app:assembleRelease through tools/gradle-serial.sh (JDK 25 from Homebrew on PATH, JAVA_HOME untouched)
-#  4. writes into infra/pi/out/apk/: kvitt-<version_code>.apk, kvitt-<version_code>.mapping.txt (R8 mapping, for
+#  3. reads KVITT_PUBLIC_HOST from infra/pi/.env (read only; refuses a missing file or key, or a CHANGE_ME value) and
+#     passes it as -Pkvitt.publicHost, the host of the app's release server and invite links (D-121)
+#  4. :app:assembleRelease through tools/gradle-serial.sh (JDK 25 from Homebrew on PATH, JAVA_HOME untouched)
+#  5. writes into infra/pi/out/apk/: kvitt-<version_code>.apk, kvitt-<version_code>.mapping.txt (R8 mapping, for
 #     reading stack traces; never served), and latest.json (written to a temp file, then renamed)
-#  5. keeps the newest 5 APKs (and their mappings) in infra/pi/out/apk/
+#  6. keeps the newest 5 APKs (and their mappings) in infra/pi/out/apk/
 # Then the owner copies the folder to the Pi and runs /opt/kvitt/install-apk.sh there (infra/README.md).
 # Refuses an unsigned build: without the kvitt.release.* keys in android/local.properties the APK cannot be
 # installed over an earlier release (D-024, D-101).
@@ -21,10 +23,22 @@ version_code="$(git rev-list --count HEAD)"
 short_sha="$(git rev-parse --short=7 HEAD)"
 commit_day="$(TZ=Europe/Stockholm git show -s --date=format-local:%Y.%m.%d --format=%cd HEAD)"
 version_name="$commit_day-$short_sha"
-echo "Release $version_name (version_code $version_code)"
+
+# The public host the app is built for (D-121), the same value and checks as infra/pi/install.sh (D-120).
+env_file="$repo_root/infra/pi/.env"
+[[ -f "$env_file" ]] || { echo "publish-apk.sh: no infra/pi/.env; cp infra/pi/.env.example infra/pi/.env and set KVITT_PUBLIC_HOST." >&2; exit 1; }
+KVITT_PUBLIC_HOST="$(sed -n 's/^KVITT_PUBLIC_HOST=//p' "$env_file" | tail -n 1)"
+[[ -n "$KVITT_PUBLIC_HOST" ]] || { echo "publish-apk.sh: infra/pi/.env has no KVITT_PUBLIC_HOST (or it is empty)." >&2; exit 1; }
+[[ "$KVITT_PUBLIC_HOST" != CHANGE_ME* ]] || { echo "publish-apk.sh: KVITT_PUBLIC_HOST in infra/pi/.env is still $KVITT_PUBLIC_HOST." >&2; exit 1; }
+[[ "$KVITT_PUBLIC_HOST" =~ ^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?\.[A-Za-z]{2,}$ ]] \
+  || { echo "publish-apk.sh: KVITT_PUBLIC_HOST in infra/pi/.env must be a host name such as kvitt.example.org (no scheme, no port), not $KVITT_PUBLIC_HOST." >&2; exit 1; }
+[[ "$KVITT_PUBLIC_HOST" != icehack.asuscomm.com ]] \
+  || { echo "publish-apk.sh: KVITT_PUBLIC_HOST cannot be icehack.asuscomm.com, NPM's proxy host for Home Assistant (D-120)." >&2; exit 1; }
+
+echo "Release $version_name (version_code $version_code) for https://$KVITT_PUBLIC_HOST:8443"
 
 PATH="/opt/homebrew/opt/openjdk@25/bin:$PATH" tools/gradle-serial.sh :app:assembleRelease \
-  "-Pkvitt.versionCode=$version_code" "-Pkvitt.versionName=$version_name"
+  "-Pkvitt.versionCode=$version_code" "-Pkvitt.versionName=$version_name" "-Pkvitt.publicHost=$KVITT_PUBLIC_HOST"
 
 out_dir="$repo_root/android/app/build/outputs/apk/release"
 apk="$out_dir/app-release.apk"
@@ -80,6 +94,7 @@ done | sort -n -r | tail -n +6 | while read -r old; do
 done
 
 echo "Staged in infra/pi/out/apk/: $file_name ($size_bytes bytes, sha256 $sha256) and latest.json."
+echo "Built for the release server https://$KVITT_PUBLIC_HOST:8443 (KVITT_PUBLIC_HOST in infra/pi/.env)."
 echo "Copy to the Pi and install (infra/README.md, Publishing an APK):"
 echo "  scp infra/pi/out/apk/latest.json infra/pi/out/apk/$file_name infra/pi/out/apk/kvitt-$version_code.mapping.txt <ssh user>@<Kvitt Pi address>:/opt/kvitt/apk/"
 echo "  ssh <ssh user>@<Kvitt Pi address> /opt/kvitt/install-apk.sh"