diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 129fa31..ad328d4 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -57,6 +57,10 @@ env:
 jobs:
   release:
     runs-on: ubuntu-latest
+    # Fail fast on a genuinely wedged run (e.g. a stalled SDK/network download on
+    # the self-hosted runner) instead of hanging forever and — because concurrency
+    # is `cancel-in-progress: false` — blocking every later release behind it.
+    timeout-minutes: 30
     # Don't loop on our own bump commit (belt-and-suspenders with [skip ci]).
     # Quoted because the expression contains a colon (`chore(release):`), which an
     # unquoted YAML scalar would misparse as a mapping value.
@@ -149,6 +153,12 @@ jobs:
       - name: Set up Android SDK
         if: ${{ steps.plan.outputs.release == 'true' }}
         uses: android-actions/setup-android@v3
+        with:
+          # Only put cmdline-tools on PATH. The action's default package set drags in
+          # the whole emulator + the legacy `tools` package (hundreds of MB, network-
+          # bound on this runner) that a headless APK build never uses. The next step
+          # installs exactly the packages we need.
+          packages: ''
 
       - name: Install Android SDK packages
         if: ${{ steps.plan.outputs.release == 'true' }}
@@ -156,17 +166,6 @@ jobs:
           set +o pipefail
           yes | sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
 
-      - name: Cache Gradle
-        if: ${{ steps.plan.outputs.release == 'true' }}
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
-
       - name: Decode signing keystore
         if: ${{ steps.plan.outputs.release == 'true' }}
         env: