diff --git a/fdroid-publish/publish.sh b/fdroid-publish/publish.sh
index c4f394c..b42f047 100644
--- a/fdroid-publish/publish.sh
+++ b/fdroid-publish/publish.sh
@@ -70,9 +70,17 @@ else
 fi
 
 if [ -z "$version_code" ]; then
-  if aapt=$(find_tool aapt2 || find_tool aapt); then
+  # Needed for the no-downgrade guard below. A bare runner image (the promote
+  # workflow's) has no Android SDK, so fetch Debian's aapt rather than guess.
+  if ! aapt=$(find_tool aapt2 || find_tool aapt); then
+    SUDO=; [ "$(id -u)" -eq 0 ] || SUDO=sudo
+    { $SUDO apt-get update -qq && $SUDO apt-get install -y -qq aapt; } >/dev/null 2>&1 || true
+    aapt=$(command -v aapt || true)
+  fi
+  if [ -n "${aapt:-}" ]; then
     version_code=$("$aapt" dump badging "$apk" 2>/dev/null | sed -n "s/.*versionCode='\([0-9]*\)'.*/\1/p" | head -n1)
   fi
+  [ -n "$version_code" ] || say "::warning::could not read the APK's versionCode — the no-downgrade guard is off for this run"
 fi
 
 head_code() { # highest versionCode the channel serves for $pkg (0 if none)