The build box should be air-gapped as it will have access to the APK signing key, which can never be changed.