diff --git a/build.py b/build.py
index 618eed2d2..cb07bc5d0 100755
--- a/build.py
+++ b/build.py
@@ -3,7 +3,8 @@ import sys
 import os
 import subprocess
 
-if os.name == 'nt':
+is_windows = os.name == 'nt'
+if is_windows:
     import colorama
     colorama.init()
 
@@ -44,6 +45,7 @@ import shutil
 import lzma
 import tempfile
 
+# Constants
 if 'ANDROID_NDK_HOME' in os.environ:
     ndk_build = os.path.join(os.environ['ANDROID_NDK_HOME'], 'ndk-build')
 else:
@@ -51,13 +53,16 @@ else:
         os.environ['ANDROID_HOME'], 'ndk-bundle', 'ndk-build')
 
 cpu_count = multiprocessing.cpu_count()
-gradlew = os.path.join('.', 'gradlew' + ('.bat' if os.name == 'nt' else ''))
+gradlew = os.path.join('.', 'gradlew' + ('.bat' if is_windows else ''))
 archs = ['armeabi-v7a', 'x86']
 arch64 = ['arm64-v8a', 'x86_64']
-config = {}
 support_targets = ['magisk', 'magiskinit', 'magiskboot', 'magiskpolicy', 'busybox', 'test']
 default_targets = ['magisk', 'magiskinit', 'magiskboot', 'busybox']
+build_tools = os.path.join(os.environ['ANDROID_HOME'], 'build-tools', '29.0.2')
 
+# Global vars
+config = {}
+STDOUT = None
 
 def mv(source, target):
     try:
@@ -159,12 +164,13 @@ def collect_binary():
 
 
 def clean_elf():
-    if os.name == 'nt':
+    if is_windows:
         elf_cleaner = os.path.join('tools', 'elf-cleaner.exe')
     else:
         elf_cleaner = os.path.join('native', 'out', 'elf-cleaner')
-    if not os.path.exists(elf_cleaner):
-        execv(['g++', 'tools/termux-elf-cleaner/termux-elf-cleaner.cpp', '-o', elf_cleaner])
+        if not os.path.exists(elf_cleaner):
+            execv(['g++', 'tools/termux-elf-cleaner/termux-elf-cleaner.cpp',
+                  '-o', elf_cleaner])
     args = [elf_cleaner]
     args.extend(os.path.join('native', 'out', arch, 'magisk') for arch in archs + arch64)
     execv(args)
@@ -293,14 +299,47 @@ def build_apk(args, module):
     proc = execv([gradlew, f'{module}:assemble{build_type}',
                  '-PconfigPath=' + os.path.abspath(args.config)])
     if proc.returncode != 0:
-        error('Build Magisk Manager failed!')
+        error(f'Build {module} failed!')
 
     build_type = build_type.lower()
     apk = f'{module}-{build_type}.apk'
 
     source = os.path.join(module, 'build', 'outputs', 'apk', build_type, apk)
     target = os.path.join(config['outdir'], apk)
-    mv(source, target)
+
+    if args.release:
+        zipalign = os.path.join(build_tools, 'zipalign' + ('.exe' if is_windows else ''))
+        aapt2 = os.path.join(build_tools, 'aapt2' + ('.exe' if is_windows else ''))
+        apksigner = os.path.join(build_tools, 'apksigner' + ('.bat' if is_windows else ''))
+        try:
+            with tempfile.NamedTemporaryFile(delete=False) as f:
+                tmp = f.name
+
+            # AAPT2 optimization
+            execv([aapt2, 'optimize', '-o', tmp, '--enable-resource-obfuscation',
+                  '--enable-resource-path-shortening', source])
+
+            # Recompress everything just to piss people off
+            with zipfile.ZipFile(source, 'w', compression=zipfile.ZIP_DEFLATED) as zout:
+                with zipfile.ZipFile(tmp) as zin:
+                    for e in zin.namelist():
+                        zout.writestr(e, zin.read(e))
+
+            # Zipalign
+            execv([zipalign, '-fz', '4', source, target])
+
+            # Sign APK
+            execv([apksigner, 'sign', '--v1-signer-name', 'CERT',
+                  '--ks', config['keyStore'],
+                  '--ks-pass', f'pass:{config["keyStorePass"]}',
+                  '--ks-key-alias', config['keyAlias'],
+                  '--key-pass', f'pass:{config["keyPass"]}', target])
+        finally:
+            rm(tmp)
+            rm(source)
+    else:
+        mv(source, target)
+
     header('Output: ' + target)
     return target
 
@@ -343,7 +382,8 @@ def build_snet(args):
 def zip_main(args):
     header('* Packing Flashable Zip')
 
-    unsigned = tempfile.mkstemp()[1]
+    with tempfile.NamedTemporaryFile(delete=False) as f:
+        unsigned = f.name
 
     with zipfile.ZipFile(unsigned, 'w', compression=zipfile.ZIP_DEFLATED, allowZip64=False) as zipf:
         # update-binary
@@ -401,13 +441,15 @@ def zip_main(args):
     output = os.path.join(config['outdir'], f'Magisk-v{config["version"]}.zip' if config['prettyName'] else
                           'magisk-release.zip' if args.release else 'magisk-debug.zip')
     sign_zip(unsigned, output, args.release)
+    rm(unsigned)
     header('Output: ' + output)
 
 
 def zip_uninstaller(args):
     header('* Packing Uninstaller Zip')
 
-    unsigned = tempfile.mkstemp()[1]
+    with tempfile.NamedTemporaryFile(delete=False) as f:
+        unsigned = f.name
 
     with zipfile.ZipFile(unsigned, 'w', compression=zipfile.ZIP_DEFLATED, allowZip64=False) as zipf:
         # update-binary
@@ -446,6 +488,7 @@ def zip_uninstaller(args):
     output = os.path.join(config['outdir'], f'Magisk-uninstaller-{datestr}.zip'
                           if config['prettyName'] else 'magisk-uninstaller.zip')
     sign_zip(unsigned, output, args.release)
+    rm(unsigned)
     header('Output: ' + output)