diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index a963f13..37ec57a 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -113,5 +113,5 @@ jobs:
       - name: Make gradlew executable
         run: chmod +x ./gradlew
 
-      - name: Build debug APK
-        run: ./gradlew assembleDebug -x lint
+      - name: Build both flavors (playstore + sms)
+        run: ./gradlew assemblePlaystoreDebug assembleSmsDebug -x lint
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3130d26..ebd3710 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -108,17 +108,20 @@ jobs:
       - name: Make gradlew executable
         run: chmod +x ./gradlew
 
-      # Build debug APK (auto-signed with Android's debug keystore)
-      # so users can actually install it via sideload. An unsigned release
-      # APK is rejected by Android with "package appears to be invalid".
-      - name: Build debug APK
-        run: ./gradlew assembleDebug -x lint
-
-      - name: Rename APK
+      # Build both flavor variants as debug APKs (auto-signed with Android's
+      # debug keystore so they install via sideload):
+      #   - playstore flavor: no SMS permission (matches Play Store build)
+      #   - sms flavor: SEND_SMS permission included (optional variant)
+      - name: Build debug APKs (playstore + sms flavors)
+        run: ./gradlew assemblePlaystoreDebug assembleSmsDebug -x lint
+
+      - name: Rename APKs
         run: |
           mkdir -p release-artifacts
-          cp app/build/outputs/apk/debug/app-debug.apk \
+          cp app/build/outputs/apk/playstore/debug/app-playstore-debug.apk \
              "release-artifacts/zenlock-v${{ steps.bump.outputs.new_version }}-debug.apk"
+          cp app/build/outputs/apk/sms/debug/app-sms-debug.apk \
+             "release-artifacts/zenlock-v${{ steps.bump.outputs.new_version }}-sms-debug.apk"
 
       - name: Commit version bump
         run: |
@@ -230,7 +233,13 @@ jobs:
             ${{ steps.changelog.outputs.changelog }}
 
             ---
-            **The APK attached below is a debug build** (for developers and testers only).
+            ### Downloads
+
+            Two debug APKs are attached below (both auto-signed with Android's debug keystore so they install via sideload):
+
+            - **`zenlock-vX.Y.Z-debug.apk`** — default build, matches the Play Store version (no SMS permission).
+            - **`zenlock-vX.Y.Z-sms-debug.apk`** — same app with SMS accountability-partner support enabled.
+
             You may need to uninstall the Play Store version first (different signature).
             For the official release, install from [Google Play](https://play.google.com/store/apps/details?id=com.grepguru.zenlock).
           files: release-artifacts/*.apk
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index cec0f1b..20daf9c 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -43,8 +43,31 @@ android {
         sourceCompatibility = JavaVersion.VERSION_15
         targetCompatibility = JavaVersion.VERSION_15
     }
+
+    // Product flavors:
+    //   playstore = default build, no SMS permission. Used for Google Play releases
+    //               and for the default GitHub artifact.
+    //   sms       = adds SEND_SMS permission via a flavor-specific manifest in
+    //               app/src/sms/AndroidManifest.xml. Built only by CI and
+    //               attached to GitHub Releases as an optional "SMS-enabled" variant.
+    //               Named "sms" (not "github") so CI task names and APK filenames
+    //               clearly indicate which variant includes the SMS feature.
+    flavorDimensions += "dist"
+    productFlavors {
+        create("playstore") {
+            dimension = "dist"
+            isDefault = true
+        }
+        create("sms") {
+            dimension = "dist"
+            versionNameSuffix = "-sms"
+        }
+    }
 }
 
+// Android Studio Build Variants panel defaults to playstoreDebug / playstoreRelease
+// so local builds never accidentally include the SMS permission.
+
 dependencies {
 
     implementation(libs.appcompat)
diff --git a/app/src/sms/AndroidManifest.xml b/app/src/sms/AndroidManifest.xml
new file mode 100644
index 0000000..3b90fef
--- /dev/null
+++ b/app/src/sms/AndroidManifest.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  This manifest is merged only into the "sms" product flavor.
+  It adds the SEND_SMS permission so the accountability-partner OTP feature
+  works in the SMS-enabled variant distributed on GitHub Releases.
+  The default "playstore" flavor does NOT include this permission.
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-permission android:name="android.permission.SEND_SMS" />
+</manifest>