diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..7dff5cc
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,54 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+          cache-dependency-path: service/go.sum
+
+      - name: Vet
+        working-directory: service
+        run: go vet ./...
+
+      - name: Build static linux/amd64 binary
+        working-directory: service
+        env:
+          CGO_ENABLED: "0"
+          GOOS: linux
+          GOARCH: amd64
+        run: |
+          go build -trimpath -ldflags="-s -w" -o weircon-random-proxy .
+          ls -lh weircon-random-proxy
+
+      - name: Stage release bundle
+        run: |
+          VERSION="${{ github.ref_name }}"
+          STAGE="weircon-random-proxy-${VERSION}-linux-amd64"
+          mkdir -p "dist/${STAGE}"
+          cp service/weircon-random-proxy "dist/${STAGE}/"
+          cp -r lxc npm README.md "dist/${STAGE}/"
+          tar -C dist -czf "dist/${STAGE}.tar.gz" "${STAGE}"
+          sha256sum "dist/${STAGE}.tar.gz" "dist/${STAGE}/weircon-random-proxy" > dist/SHA256SUMS
+          ls -lh dist/
+
+      - name: Upload release asset
+        uses: https://gitea.com/actions/gitea-release-action@v1
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          server_url: ${{ github.server_url }}
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          files: |
+            dist/weircon-random-proxy-${{ github.ref_name }}-linux-amd64.tar.gz
+            dist/weircon-random-proxy-${{ github.ref_name }}-linux-amd64/weircon-random-proxy
+            dist/SHA256SUMS