diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 0000000..f5700d6
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,17 @@
+name: ci
+
+on:
+  push:
+    branches: ["**"]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        run: scripts/ci-setup.sh
+      - name: Unit tests
+        run: mise run test
+      - name: Type checks
+        run: mise run check
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
new file mode 100644
index 0000000..3088037
--- /dev/null
+++ b/.gitea/workflows/release.yaml
@@ -0,0 +1,50 @@
+name: release
+
+# Push a tag like v0.2.0 to build Linux and Windows packages and attach them
+# to a Gitea release of that tag.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      # AppImage tools need FUSE, which containers lack; this unpacks them instead.
+      APPIMAGE_EXTRACT_AND_RUN: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        run: scripts/ci-setup.sh --windows
+      - name: Take the version from the tag
+        run: |
+          node -e '
+            const fs = require("fs");
+            const p = "src-tauri/tauri.conf.json";
+            const c = JSON.parse(fs.readFileSync(p));
+            c.version = process.env.GITHUB_REF_NAME.replace(/^v/, "");
+            fs.writeFileSync(p, JSON.stringify(c, null, 2));
+          '
+      - name: Unit tests
+        run: mise run test
+      - name: Build Linux
+        run: pnpm tauri build --bundles deb,rpm,appimage
+      - name: Build Windows
+        run: pnpm tauri build --runner cargo-xwin --target x86_64-pc-windows-msvc --bundles nsis
+      - name: Collect files
+        run: |
+          mkdir -p release
+          cp src-tauri/target/release/bundle/deb/*.deb release/
+          cp src-tauri/target/release/bundle/rpm/*.rpm release/
+          cp src-tauri/target/release/bundle/appimage/*.AppImage release/
+          cp src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe release/
+          cp src-tauri/target/x86_64-pc-windows-msvc/release/gites.exe "release/gites_${GITHUB_REF_NAME#v}_x64_portable.exe"
+          ls -la release
+      - name: Publish release
+        uses: https://gitea.com/actions/release-action@main
+        with:
+          files: release/*
+          api_key: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/scripts/ci-setup.sh b/scripts/ci-setup.sh
new file mode 100755
index 0000000..4021439
--- /dev/null
+++ b/scripts/ci-setup.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Installs everything the CI jobs need on a Debian/Ubuntu runner.
+# Pass --windows to also install the tools for cross-compiling the Windows build.
+set -euo pipefail
+
+SUDO=$(command -v sudo || true)
+export DEBIAN_FRONTEND=noninteractive
+
+packages=(
+  build-essential curl wget file xdg-utils pkg-config
+  libwebkit2gtk-4.1-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev
+)
+if [[ "${1:-}" == "--windows" ]]; then
+  packages+=(nsis lld llvm clang)
+fi
+$SUDO apt-get update -q
+$SUDO apt-get install -yq --no-install-recommends "${packages[@]}"
+
+# Rust: not pinned in mise.toml, because mise needs rustup for it.
+if ! command -v cargo >/dev/null; then
+  curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
+fi
+echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+export PATH="$HOME/.cargo/bin:$PATH"
+
+if [[ "${1:-}" == "--windows" ]]; then
+  rustup target add x86_64-pc-windows-msvc
+  cargo install --locked cargo-xwin
+fi
+
+curl -fsSL https://mise.run | MISE_VERSION=v2026.9.1 sh
+echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH"
+export PATH="$HOME/.local/bin:$HOME/.local/share/mise/shims:$PATH"
+mise trust && mise install
+pnpm install --frozen-lockfile