diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..1d2e28a
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,64 @@
+name: build
+
+# Build a versioned Linux CLI release tarball (see `make package`) on
+# every push/PR, plus on-demand via the Gitea "Run workflow" button.
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    # Runner defaults `run:` steps to `sh`, which doesn't understand
+    # `set -o pipefail` used below — force bash explicitly.
+    defaults:
+      run:
+        shell: bash
+    # Must match a label your act_runner is registered with.
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # `make package`'s version comes from `git describe --tags` (see
+          # the Makefile's `package` target) - needs full history/tags,
+          # not actions/checkout's default shallow single-commit clone.
+          fetch-depth: 0
+
+      - name: Preflight
+        run: |
+          set -euo pipefail
+          command -v cc >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: no C compiler (cc) in PATH" >&2; exit 1; }
+          command -v make >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: make not in PATH" >&2; exit 1; }
+
+      - name: Build and test
+        run: |
+          set -euo pipefail
+          make test
+          make package
+
+      - name: Upload build artifact
+        # v4 uses the newer @actions/artifact backend, which this Gitea
+        # instance's artifact storage doesn't support (GHESNotSupportedError) — v3 works.
+        uses: actions/upload-artifact@v3
+        with:
+          name: deck-in-a-dash
+          path: dist/deck-in-a-dash-*-linux-*.tar.gz
+
+      - name: Publish to dl.ladkau.de
+        # Uploads the tarball over SFTP instead of using
+        # actions/upload-artifact (whose zip wrapping can't be disabled).
+        # Only runs on push so PR builds don't publish.
+        if: gitea.event_name == 'push'
+        run: |
+          set -euo pipefail
+          FILE="$(ls dist/deck-in-a-dash-*-linux-*.tar.gz)"
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DL_SFTP_KEY }}" > ~/.ssh/dl_sftp_key
+          chmod 600 ~/.ssh/dl_sftp_key
+          sftp -i ~/.ssh/dl_sftp_key -P 2223 \
+            -o StrictHostKeyChecking=accept-new \
+            uploader@dl.ladkau.de <<EOF
+          -mkdir files/deck-in-a-dash
+          put $FILE files/deck-in-a-dash/$(basename "$FILE")
+          EOF
diff --git a/CLAUDE.md b/CLAUDE.md
index 49a59d3..85bd025 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -94,6 +94,13 @@ end up in a distributable package. The package always gets the
 placeholder template instead, identical to what a first-time `make`
 seeds `dist/user.properties` with.
 
+**CI** (`.gitea/workflows/build.yml`): runs `make test && make package`
+on every push/PR (plus manual dispatch). The resulting tarball is both
+kept as a Gitea Actions run artifact and, on `push` only (not PRs),
+published over SFTP to `dl.ladkau.de` under `files/deck-in-a-dash/` -
+requires a `DL_SFTP_KEY` secret configured on this repo (or inherited
+from the org/instance level).
+
 ## Architecture
 
 ```