diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..d5ba8db
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,25 @@
+# Gitea Actions mirror of the Woodpecker quality bar (.ci/woodpecker.yaml):
+# fmt, clippy -D warnings, full test suite.
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    container: rust:1
+    steps:
+      - uses: actions/checkout@v4
+      - name: rustfmt
+        run: |
+          rustup component add rustfmt
+          cargo fmt --all --check
+      - name: clippy
+        run: |
+          rustup component add clippy
+          cargo clippy --workspace --all-targets -- -D warnings
+      - name: test
+        run: cargo test --workspace
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..3ea3af6
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,81 @@
+# Release pipeline: a `vX.Y.Z` tag (pushed by `cargo release`, see
+# release.toml) builds distribution tarballs and attaches them to a
+# Gitea release.
+#
+# Each tarball contains the two binaries (stripped, release profile),
+# the systemd units, the example config, rendered man pages, and the
+# license/readme — everything a distro package or a hand install needs.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    container: rust:1
+    strategy:
+      matrix:
+        target: [x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: install tooling
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends scdoc jq
+          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
+            apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu
+          fi
+          rustup target add ${{ matrix.target }}
+
+      - name: build
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+        run: |
+          cargo build --workspace --release --target ${{ matrix.target }}
+
+      - name: package
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          PKG="varde-${VERSION}-${{ matrix.target }}"
+          mkdir -p "$PKG"/{bin,systemd/user,man}
+          cp "target/${{ matrix.target }}/release/varde-daemon" \
+             "target/${{ matrix.target }}/release/varde-ctl" "$PKG/bin/"
+          # Cross-strip is unavailable for the foreign target; native
+          # strip handles the host one.
+          if [ "${{ matrix.target }}" = "x86_64-unknown-linux-gnu" ]; then
+            strip "$PKG"/bin/*
+          else
+            aarch64-linux-gnu-strip "$PKG"/bin/*
+          fi
+          cp dist/varde.service dist/varde.socket "$PKG/systemd/"
+          cp dist/user/varde.service dist/user/varde.socket "$PKG/systemd/user/"
+          cp dist/config.toml "$PKG/config.toml.example"
+          scdoc < dist/varde.8.scd > "$PKG/man/varde.8"
+          scdoc < dist/varde-ctl.1.scd > "$PKG/man/varde-ctl.1"
+          cp README.md SPECS.md "$PKG/"
+          tar czf "$PKG.tar.gz" "$PKG"
+          sha256sum "$PKG.tar.gz" > "$PKG.tar.gz.sha256"
+
+      - name: create release and upload
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          # Create the release if this matrix job is first; 409 = the
+          # other job already made it.
+          curl -sf -X POST "$API/releases" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\": \"${GITHUB_REF_NAME}\", \"name\": \"${GITHUB_REF_NAME}\", \"draft\": false}" \
+            || true
+          RELEASE_ID=$(curl -sf "$API/releases/tags/${GITHUB_REF_NAME}" \
+            -H "Authorization: token $TOKEN" | jq .id)
+          for f in varde-*.tar.gz varde-*.tar.gz.sha256; do
+            curl -sf -X POST \
+              "$API/releases/${RELEASE_ID}/assets?name=$(basename "$f")" \
+              -H "Authorization: token $TOKEN" \
+              -F "attachment=@$f"
+          done
diff --git a/README.md b/README.md
index 186361b..e789bc6 100644
--- a/README.md
+++ b/README.md
@@ -71,3 +71,14 @@ $ cargo clippy --workspace --all-targets -- -D warnings
 
 The `metered` feature (default on) needs D-Bus at runtime only; build
 with `--no-default-features` for systems without it.
+
+## Releasing
+
+```console
+$ cargo release patch      # or minor / major — see release.toml
+```
+
+This bumps the workspace version, tags `vX.Y.Z`, and pushes; the tag
+triggers `.gitea/workflows/release.yml`, which builds x86_64 and
+aarch64 Linux tarballs (binaries, systemd units, man pages, example
+config) and attaches them to the Gitea release.
diff --git a/dist/PKGBUILD b/dist/PKGBUILD
index 7957e43..f92a09f 100644
--- a/dist/PKGBUILD
+++ b/dist/PKGBUILD
@@ -8,7 +8,7 @@ pkgver=0.1.0
 pkgrel=1
 pkgdesc="Content-addressed blob mirror daemon on iroh"
 arch=('x86_64' 'aarch64')
-url="https://github.com/bendiklh/varde"
+url="https://project.uhhm.no/uhhm/varde"
 license=('MIT OR Apache-2.0')
 depends=('gcc-libs')
 optdepends=('networkmanager: metered-connection detection')
diff --git a/release.toml b/release.toml
new file mode 100644
index 0000000..254f06a
--- /dev/null
+++ b/release.toml
@@ -0,0 +1,23 @@
+# cargo-release configuration (https://github.com/crate-ci/cargo-release).
+#
+# Usage, from a clean main checkout:
+#
+#     cargo release patch          # or minor / major / an explicit x.y.z
+#
+# This bumps every workspace crate in lockstep, commits, tags `vX.Y.Z`,
+# and pushes commit + tag. The tag push triggers the release workflow
+# (.gitea/workflows/release.yml), which builds and attaches the
+# distribution tarballs. Nothing is published to crates.io.
+
+# One version for the whole workspace; a single `vX.Y.Z` tag.
+shared-version = true
+tag-name = "v{{version}}"
+consolidate-commits = true
+pre-release-commit-message = "release v{{version}}"
+
+# Distribution is tarballs + PKGBUILD, not crates.io.
+publish = false
+push = true
+
+# The full quality bar must pass before anything is committed.
+pre-release-hook = ["cargo", "test", "--workspace"]