diff --git a/.gitea/workflows/testflight.yml b/.gitea/workflows/testflight.yml
index eba1396..23a6fdb 100644
--- a/.gitea/workflows/testflight.yml
+++ b/.gitea/workflows/testflight.yml
@@ -62,6 +62,7 @@ jobs:
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
           MATCH_GIT_URL: ${{ secrets.MATCH_GIT_URL }}
           MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}
+          SYBIL_BUILD_NUMBER: ${{ github.run_number }}
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
         run: |
diff --git a/ios/fastlane/Fastfile b/ios/fastlane/Fastfile
index 162f322..0a4f855 100644
--- a/ios/fastlane/Fastfile
+++ b/ios/fastlane/Fastfile
@@ -40,6 +40,21 @@ def ci?
   present?(ENV["CI"])
 end
 
+# App Store Connect requires CFBundleVersion to be unique and strictly
+# increasing app-wide (not just per marketing version), so we derive it from
+# the monotonic CI run number rather than querying TestFlight (that query can
+# lag behind builds still processing and hand back a colliding value).
+def build_number
+  value = ENV["SYBIL_BUILD_NUMBER"].to_s
+  value = ENV["GITHUB_RUN_NUMBER"].to_s if !present?(value)
+
+  unless value.match?(/\A\d+\z/)
+    UI.user_error!("Build number must come from SYBIL_BUILD_NUMBER/GITHUB_RUN_NUMBER; got #{value.inspect}")
+  end
+
+  value.to_i
+end
+
 def ci_keychain_path
   File.file?(CI_KEYCHAIN_DB_PATH) ? CI_KEYCHAIN_DB_PATH : CI_KEYCHAIN_PATH
 end
@@ -154,14 +169,8 @@ platform :ios do
       xcodeproj: PROJECT_FILE
     )
 
-    latest_build_number = latest_testflight_build_number(
-      app_identifier: APP_IDENTIFIER,
-      api_key: api_key,
-      initial_build_number: 0
-    )
-
     increment_build_number(
-      build_number: latest_build_number + 1,
+      build_number: build_number,
       xcodeproj: PROJECT_FILE
     )