new file mode 100644
--- /dev/null
+++ b/modules/packages/manifests/mozilla/android_sdk.pp
@@ -0,0 +1,48 @@
+define packages::mozilla::android_sdk(
+    $basedir = '/tools/android-sdk',
+    $build_tools_version = "$title",
+    $zipalign_location = "$basedir/build-tools/$build_tools_version/zipalign",
+
+    $username,
+    $group,
+) {
+  $archive_file_name = "android-sdk-linux_build-tools-$build_tools_version.tar.xz"
+  $archive_location = "$basedir/$archive_file_name"
+
+  File {
+    mode      => 640,
+    owner     => $username,
+    group     => $group,
+    show_diff => false,
+  }
+
+  file {
+    $basedir:
+      ensure => directory;
+
+    $archive_location:
+      ensure  => file,
+      source  => "puppet:///repos$p/ZIPs/$archive_file_name";
+  }
+
+  exec {
+    "/bin/tar xvf $archive_location --strip-components=1":  # strip-components removes the first directory called "android-sdk-linux"
+      creates => $zipalign_location,
+      cwd     => $basedir,
+      group   => $group,
+      require => File[$archive_location],
+      user    => $username;
+  }
+
+  case $::operatingsystem {
+    CentOS: {
+      package {
+          [ 'glibc.i686', 'zlib.i686', 'libstdc++.i686' ]:
+              ensure => latest;
+      }
+    }
+    default: {
+      fail("cannot install on $::operatingsystem")
+    }
+  }
+}

--- a/modules/signing_scriptworker/manifests/init.pp
+++ b/modules/signing_scriptworker/manifests/init.pp
@@ -5,16 +5,19 @@ class signing_scriptworker {
     include packages::mozilla::python35
     include users::signer
     include tweaks::swap_on_instance_storage
     include packages::gcc
     include packages::make
 
     # because puppet barfs whenever I try to put it in settings.pp
     $verbose_logging = true
+    $build_tools_version = '23.0.3'
+    # See value defined in packages::mozilla::android_sdk
+    $zipalign_location = "/tools/android-sdk/build-tools/$build_tools_version/zipalign"
 
     python35::virtualenv {
         "${signing_scriptworker::settings::root}":
             python3  => "${packages::mozilla::python35::python3}",
             require  => Class["packages::mozilla::python35"],
             user     => "${users::signer::username}",
             group    => "${users::signer::group}",
             mode     => 700,
@@ -38,17 +41,17 @@ class signing_scriptworker {
                   "ptyprocess==0.5.1",
                   "pycrypto==2.6.1",
                   "pyparsing==2.1.10",
                   "python-dateutil==2.6.0",
                   "python-gnupg==0.4.0",
                   "python-jose==1.3.2",
                   "requests==2.13.0",
                   "scriptworker==2.1.1",
-                  "signingscript==0.9.0",
+                  "signingscript==0.10.1",
                   "signtool==2.0.3",
                   "six==1.10.0",
                   "slugid==1.0.7",
                   "taskcluster==1.0.2",
                   "virtualenv==15.1.0",
                   "yarl==0.8.1",
             ];
     }
@@ -103,9 +106,16 @@ class signing_scriptworker {
             show_diff   => true;
         "${signing_scriptworker::settings::root}/file_age_check_required.txt":
             mode        => 640,
             owner       => "${users::signer::username}",
             group       => "${users::signer::group}",
             source      => "puppet:///modules/signing_scriptworker/file_age_check_required.txt",
             show_diff   => true;
     }
+
+    packages::mozilla::android_sdk {
+      $build_tools_version:
+        username          => $users::signer::username,
+        group             => $users::signer::group,
+        zipalign_location => $zipalign_location;
+    }
 }

--- a/modules/signing_scriptworker/templates/script_config.json.erb
+++ b/modules/signing_scriptworker/templates/script_config.json.erb
@@ -3,10 +3,11 @@
     "artifact_dir": "<%= scope.lookupvar("signing_scriptworker::settings::root") %>/artifacts",
 
     "my_ip": "<%= @ipaddress %>",
     "signing_server_config": "<%= scope.lookupvar("signing_scriptworker::settings::root") %>/passwords.json",
     "ssl_cert": "<%= scope.lookupvar("signing_scriptworker::settings::root") %>/lib/python3.5/site-packages/signingscript/data/host.cert",
     "schema_file": "<%= scope.lookupvar("signing_scriptworker::settings::root") %>/lib/python3.5/site-packages/signingscript/data/signing_task_schema.json",
 
     "signtool": "<%= scope.lookupvar("signing_scriptworker::settings::root") %>/bin/signtool",
-    "verbose": <%= @verbose_logging %>
+    "verbose": <%= @verbose_logging %>,
+    "zipalign": "<%= @zipalign_location %>"
 }