diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..6479020
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,132 @@
+.PHONY: help debug build-release release deploy deploy-debug pub-get
+
+.ONESHELL:
+SHELL := /bin/bash
+.SHELLFLAGS := -eu -o pipefail -c
+
+FLUTTER := fvm flutter
+APK_DIR := build/app/outputs/flutter-apk
+DEBUG_APK := $(APK_DIR)/app-arm64-v8a-debug.apk
+RELEASE_APK := $(APK_DIR)/app-arm64-v8a-release.apk
+CURRENT_VERSION := $(shell awk '/^version:/ {print $$2; exit}' pubspec.yaml)
+CURRENT_NAME := $(word 1,$(subst +, ,$(CURRENT_VERSION)))
+CURRENT_CODE := $(word 2,$(subst +, ,$(CURRENT_VERSION)))
+
+# Reproducible release builds honor SOURCE_DATE_EPOCH (see spec/guidelines/INVARIANTS.md).
+SOURCE_DATE_EPOCH ?= $(shell git log -1 --format=%ct 2>/dev/null || date +%s)
+
+ARM64_FLAGS := --split-per-abi --target-platform android-arm64
+RED := \033[0;31m
+GREEN := \033[0;32m
+YELLOW := \033[1;33m
+NC := \033[0m
+
+define deploy-apk-cmd
+	set -e; \
+	apk='$(1)'; \
+	if [ ! -f "$$apk" ]; then \
+		echo "Missing $$apk. Build it first."; \
+		exit 1; \
+	fi; \
+	devices=$$(adb devices | awk 'NR>1 && $$2=="device" {print $$1}'); \
+	if [ -z "$$devices" ]; then \
+		echo "No connected Android devices or emulators found."; \
+		adb devices; \
+		exit 1; \
+	fi; \
+	if [ -n "$$(printf '%s\n' "$$devices" | sed -n '2p')" ]; then \
+		echo "Multiple physical devices connected:"; \
+		printf '  %s\n' $$devices; \
+		exit 1; \
+	fi; \
+	serial=$$(printf '%s\n' "$$devices" | sed -n '1p'); \
+	echo "Installing $$apk on $$serial..."; \
+	adb -s "$$serial" install -r "$$apk"
+endef
+
+help:
+	@echo "  make debug        $(DEBUG_APK)"
+	@echo "  make release      prepare and build a release"
+	@echo "  make deploy       prepare, build, and install release APK"
+	@echo "  make deploy-debug build and install debug APK"
+
+pub-get:
+	$(FLUTTER) pub get
+
+debug: pub-get
+	$(FLUTTER) build apk --debug $(ARM64_FLAGS)
+	@test -f $(DEBUG_APK)
+
+build-release: pub-get
+	SOURCE_DATE_EPOCH=$(SOURCE_DATE_EPOCH) $(FLUTTER) build apk --release $(ARM64_FLAGS)
+	@test -f $(RELEASE_APK)
+
+release:
+	@if [[ -n "$$(git status --porcelain)" ]]; then \
+		printf "$(RED)Error: Working tree is not clean. Commit or stash changes first.$(NC)\n"; \
+		exit 1; \
+	fi; \
+	current_branch="$$(git rev-parse --abbrev-ref HEAD)"; \
+	if [[ "$$current_branch" != "master" ]]; then \
+		printf "$(YELLOW)Warning: Not on master branch (currently on %s)$(NC)\n" "$$current_branch"; \
+		read -r -p "Continue anyway? (y/N) " reply; \
+		[[ "$$reply" =~ ^[Yy]$$ ]]; \
+	fi; \
+	printf "$(GREEN)Fetching latest changes...$(NC)\n"; \
+	git fetch origin; \
+	printf "\nCurrent version: $(YELLOW)$(CURRENT_NAME)+$(CURRENT_CODE)$(NC)\n"; \
+	printf "  Version name: $(CURRENT_NAME)\n"; \
+	printf "  Version code: $(CURRENT_CODE)\n"; \
+	read -r -p "Enter new version name (e.g. 1.0.7) or press Enter to keep current: " new_name; \
+	new_name="$${new_name:-$(CURRENT_NAME)}"; \
+	new_code=$$(($(CURRENT_CODE) + 1)); \
+	printf "\nNew version will be: $(GREEN)%s+%s$(NC)\n" "$$new_name" "$$new_code"; \
+	read -r -p "Proceed? (y/N) " reply; \
+	[[ "$$reply" =~ ^[Yy]$$ ]]; \
+	printf "\n$(GREEN)Updating version in pubspec.yaml...$(NC)\n"; \
+	sed -i.bak "s/^version: .*/version: $$new_name+$$new_code/" pubspec.yaml; \
+	rm -f pubspec.yaml.bak; \
+	trap 'git checkout -- pubspec.yaml assets/seed.db 2>/dev/null || true' EXIT; \
+	printf "\n$(GREEN)Running checks...$(NC)\n"; \
+	$(FLUTTER) pub get; \
+	$(FLUTTER) analyze; \
+	$(FLUTTER) test; \
+	printf "\n$(GREEN)Generating seed database (assets/seed.db)...$(NC)\n"; \
+	dart run tool/seed_database.dart; \
+	printf "\n$(GREEN)Checking CHANGELOG.md...$(NC)\n"; \
+	if ! grep -q "## \[$$new_name\]" CHANGELOG.md; then \
+		printf "$(YELLOW)Warning: CHANGELOG.md does not contain an entry for [%s]$(NC)\n" "$$new_name"; \
+		read -r -p "Continue anyway? (y/N) " reply; \
+		[[ "$$reply" =~ ^[Yy]$$ ]]; \
+	fi; \
+	printf "\n$(GREEN)Building reproducible release APK...$(NC)\n"; \
+	export SOURCE_DATE_EPOCH="$(SOURCE_DATE_EPOCH)"; \
+	printf "  Using SOURCE_DATE_EPOCH=%s\n" "$$SOURCE_DATE_EPOCH"; \
+	$(FLUTTER) build apk --release $(ARM64_FLAGS); \
+	test -f "$(RELEASE_APK)"; \
+	apk_size="$$(du -h "$(RELEASE_APK)" | cut -f1)"; \
+	apk_sha256="$$(shasum -a 256 "$(RELEASE_APK)" | cut -d' ' -f1)"; \
+	printf "\n$(GREEN)Build successful!$(NC)\n"; \
+	printf "  APK: %s\n  Size: %s\n  SHA256: %s\n" "$(RELEASE_APK)" "$$apk_size" "$$apk_sha256"; \
+	printf "\n$(GREEN)Changes to be committed:$(NC)\n"; \
+	git diff --stat pubspec.yaml assets/seed.db; \
+	git add pubspec.yaml assets/seed.db; \
+	git commit -m "Release $$new_name+$$new_code"; \
+	trap - EXIT; \
+	tag_name="v$$new_name"; \
+	printf "\n$(GREEN)Creating git tag: %s$(NC)\n" "$$tag_name"; \
+	git tag -a "$$tag_name" -m "Release $$new_name (build $$new_code)"; \
+	printf "\n$(GREEN)=== Release Ready ===$(NC)\n"; \
+	printf "Version: $(GREEN)%s+%s$(NC)\nTag: $(GREEN)%s$(NC)\nAPK SHA256: $(YELLOW)%s$(NC)\n" "$$new_name" "$$new_code" "$$tag_name" "$$apk_sha256"; \
+	printf "\nNext steps:\n"; \
+	printf "  1. Review the commit: git show\n"; \
+	printf "  2. Push to remote: git push origin master && git push origin %s\n" "$$tag_name"; \
+	printf "  3. Create GitHub release with the APK\n"; \
+	printf "\nTo rebuild this APK reproducibly:\n"; \
+	printf "  git checkout %s\n  export SOURCE_DATE_EPOCH=%s\n  $(FLUTTER) build apk --release $(ARM64_FLAGS)\n" "$$tag_name" "$$SOURCE_DATE_EPOCH"
+
+deploy: release
+	@$(call deploy-apk-cmd,$(RELEASE_APK))
+
+deploy-debug: debug
+	@$(call deploy-apk-cmd,$(DEBUG_APK))
diff --git a/spec/work/WORK-017-make-release.md b/spec/work/WORK-017-make-release.md
new file mode 100644
index 0000000..5e9fda7
--- /dev/null
+++ b/spec/work/WORK-017-make-release.md
@@ -0,0 +1,40 @@
+# WORK-017 — Makefile Release Workflow
+
+**Feature:** None
+**Status:** Complete
+
+## Tasks
+
+- [x] 1. Move the release workflow from `tool/release.sh` into `Makefile`.
+- [x] 2. Make `deploy` depend on `release` and `deploy-debug` depend on `debug`.
+- [x] 3. Remove the superseded release script.
+- [x] 4. Self-review against `spec/guidelines/INVARIANTS.md`.
+
+## Test Coverage
+
+| Scenario | Expected | Status |
+|----------|----------|--------|
+| `make -n release` | Makefile parses the release recipe | [x] |
+| `make -n deploy-debug` | Debug build is a prerequisite | [x] |
+| Dependency inspection | `deploy: release`, `deploy-debug: debug` | [x] |
+| Release failure before commit | Version and generated seed data are restored | [x] |
+
+## Decisions
+
+### 2026-07-12 — Keep release preparation under `make release`
+
+**Context:** `tool/release.sh` bundled versioning, validation, seed generation, APK creation, commit, and tagging.
+**Decision:** Preserve that workflow in the `release` target so the script has a complete Makefile replacement.
+**Rationale:** Existing release behavior remains available through one documented command, while deploy targets can declare their build prerequisites.
+
+## Spec Issues
+
+_None_
+
+## Progress Notes
+
+**2026-07-12:** Migrated the release workflow, wired deploy dependencies, removed `tool/release.sh`, and validated execution with macOS BSD `make`.
+
+## On Merge
+
+Delete this work packet.
diff --git a/tool/release.sh b/tool/release.sh
deleted file mode 100755
index 23d7f1d..0000000
--- a/tool/release.sh
+++ /dev/null
@@ -1,151 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-echo -e "${GREEN}=== Zapstore Release Script ===${NC}\n"
-
-# 1. Check working tree is clean
-if [[ -n $(git status --porcelain) ]]; then
-  echo -e "${RED}Error: Working tree is not clean. Commit or stash changes first.${NC}"
-  exit 1
-fi
-
-# 2. Ensure we're on master and up to date
-CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
-if [[ "$CURRENT_BRANCH" != "master" ]]; then
-  echo -e "${YELLOW}Warning: Not on master branch (currently on $CURRENT_BRANCH)${NC}"
-  read -p "Continue anyway? (y/N) " -n 1 -r
-  echo
-  if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-    exit 1
-  fi
-fi
-
-echo -e "${GREEN}Fetching latest changes...${NC}"
-git fetch origin
-
-# 3. Parse current version from pubspec.yaml
-CURRENT_VERSION=$(grep '^version:' pubspec.yaml | sed 's/version: //')
-CURRENT_NAME=$(echo "$CURRENT_VERSION" | cut -d'+' -f1)
-CURRENT_CODE=$(echo "$CURRENT_VERSION" | cut -d'+' -f2)
-
-echo -e "\nCurrent version: ${YELLOW}$CURRENT_NAME+$CURRENT_CODE${NC}"
-echo -e "  Version name: $CURRENT_NAME"
-echo -e "  Version code: $CURRENT_CODE"
-
-# 4. Prompt for new version
-read -p "Enter new version name (e.g. 1.0.7) or press Enter to keep current: " NEW_NAME
-NEW_NAME=${NEW_NAME:-$CURRENT_NAME}
-
-NEW_CODE=$((CURRENT_CODE + 1))
-echo -e "\nNew version will be: ${GREEN}$NEW_NAME+$NEW_CODE${NC}"
-read -p "Proceed? (y/N) " -n 1 -r
-echo
-if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-  exit 1
-fi
-
-# 5. Update version in pubspec.yaml
-echo -e "\n${GREEN}Updating version in pubspec.yaml...${NC}"
-sed -i.bak "s/^version: .*/version: $NEW_NAME+$NEW_CODE/" pubspec.yaml
-rm pubspec.yaml.bak
-
-# 6. Run checks
-echo -e "\n${GREEN}Running checks...${NC}"
-
-echo "  - fvm flutter pub get"
-fvm flutter pub get
-
-echo "  - fvm flutter analyze"
-if ! fvm flutter analyze; then
-  echo -e "${RED}Error: Lint/analysis errors found. Fix them first.${NC}"
-  git checkout pubspec.yaml
-  exit 1
-fi
-
-echo "  - fvm flutter test"
-if ! fvm flutter test; then
-  echo -e "${RED}Error: Tests failed. Fix them first.${NC}"
-  git checkout pubspec.yaml
-  exit 1
-fi
-
-# 7. Pull latest apps into seed.db
-echo -e "\n${GREEN}Generating seed database (assets/seed.db)...${NC}"
-if ! dart run tool/seed_database.dart; then
-  echo -e "${RED}Error: Failed to generate seed database.${NC}"
-  git checkout pubspec.yaml
-  exit 1
-fi
-
-# 8. Check that CHANGELOG.md was updated
-echo -e "\n${GREEN}Checking CHANGELOG.md...${NC}"
-if ! grep -q "## \[$NEW_NAME\]" CHANGELOG.md; then
-  echo -e "${YELLOW}Warning: CHANGELOG.md does not contain an entry for [$NEW_NAME]${NC}"
-  echo "Please update CHANGELOG.md before proceeding."
-  read -p "Continue anyway? (y/N) " -n 1 -r
-  echo
-  if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-    git checkout pubspec.yaml assets/seed.db
-    exit 1
-  fi
-fi
-
-# 9. Build reproducible APK
-echo -e "\n${GREEN}Building reproducible release APK...${NC}"
-
-# Set SOURCE_DATE_EPOCH for reproducibility (use git commit timestamp)
-export SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
-echo "  Using SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
-
-# Build unsigned APK (reproducible)
-fvm flutter build apk --release --split-per-abi
-
-APK_PATH="build/app/outputs/flutter-apk/app-arm64-v8a-release.apk"
-if [[ ! -f "$APK_PATH" ]]; then
-  echo -e "${RED}Error: APK not found at $APK_PATH${NC}"
-  git checkout pubspec.yaml assets/seed.db
-  exit 1
-fi
-
-APK_SIZE=$(du -h "$APK_PATH" | cut -f1)
-APK_SHA256=$(shasum -a 256 "$APK_PATH" | cut -d' ' -f1)
-
-echo -e "\n${GREEN}Build successful!${NC}"
-echo "  APK: $APK_PATH"
-echo "  Size: $APK_SIZE"
-echo "  SHA256: $APK_SHA256"
-
-# 10. Show what will be committed
-echo -e "\n${GREEN}Changes to be committed:${NC}"
-git diff --stat pubspec.yaml assets/seed.db
-
-# 11. Commit and tag
-echo -e "\n${GREEN}Creating release commit...${NC}"
-git add pubspec.yaml assets/seed.db
-
-COMMIT_MSG="Release $NEW_NAME+$NEW_CODE"
-git commit -m "$COMMIT_MSG"
-
-TAG_NAME="v$NEW_NAME"
-echo -e "\n${GREEN}Creating git tag: $TAG_NAME${NC}"
-git tag -a "$TAG_NAME" -m "Release $NEW_NAME (build $NEW_CODE)"
-
-# 12. Summary
-echo -e "\n${GREEN}=== Release Ready ===${NC}"
-echo -e "Version: ${GREEN}$NEW_NAME+$NEW_CODE${NC}"
-echo -e "Tag: ${GREEN}$TAG_NAME${NC}"
-echo -e "APK SHA256: ${YELLOW}$APK_SHA256${NC}"
-echo -e "\nNext steps:"
-echo "  1. Review the commit: git show"
-echo "  2. Push to remote: git push origin master && git push origin $TAG_NAME"
-echo "  3. Create GitHub release with the APK"
-echo -e "\nTo rebuild this APK reproducibly, anyone can:"
-echo "  git checkout $TAG_NAME"
-echo "  export SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
-echo "  fvm flutter build apk --release --split-per-abi"