diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..3d4e6b1
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,88 @@
+name: ForgeFlow signed release
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - package.json
+  workflow_dispatch:
+
+permissions:
+  code: read
+  releases: write
+
+jobs:
+  release:
+    runs-on: windows-native
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: Build, sign and publish version bump
+        shell: powershell
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          FORGEFLOW_RELEASE_BASE_URL: ${{ gitea.server_url }}
+          FORGEFLOW_RELEASE_OWNER: Jens
+          FORGEFLOW_RELEASE_REPO: ForgeFlow
+          FORGEFLOW_RELEASE_BRANCH: main
+          FORGEFLOW_RELEASE_SIGNING_KEY_PEM: ${{ secrets.FORGEFLOW_RELEASE_SIGNING_KEY_PEM }}
+        run: |
+          $ErrorActionPreference = "Stop"
+          Set-StrictMode -Version Latest
+
+          $manifest = Get-Content -LiteralPath "package.json" -Raw | ConvertFrom-Json
+          $version = [string]$manifest.version
+          $previousVersion = ""
+          try {
+            $previousJson = (& git show "HEAD^:package.json" 2>$null | Out-String)
+            if ($LASTEXITCODE -eq 0 -and $previousJson.Trim()) {
+              $previousVersion = [string](ConvertFrom-Json $previousJson).version
+            }
+          } catch {
+            $previousVersion = ""
+          }
+
+          if ($env:GITEA_EVENT_NAME -eq "push" -and $previousVersion -eq $version) {
+            Write-Host "package.json changed without a version bump ($version); no release will be published."
+            exit 0
+          }
+          if ($version -notmatch '^\d+\.\d+\.\d+$') {
+            throw "ForgeFlow version '$version' is not a stable semantic version."
+          }
+
+          if ($env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM) {
+            $privateKeyPath = Join-Path $env:RUNNER_TEMP "forgeflow-release-signing-private.pem"
+            $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+            [System.IO.File]::WriteAllText($privateKeyPath, $env:FORGEFLOW_RELEASE_SIGNING_KEY_PEM, $utf8NoBom)
+            $env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY = $privateKeyPath
+          }
+
+          $effectiveKeyPath = if ($env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY) {
+            $env:FORGEFLOW_UPDATE_SIGNING_PRIVATE_KEY
+          } else {
+            Join-Path $env:APPDATA "forgeflow\release-signing-private.pem"
+          }
+          if (-not (Test-Path -LiteralPath $effectiveKeyPath)) {
+            throw "ForgeFlow release signing key is not provisioned for the windows-native runner. Provision the existing Ed25519 private key as FORGEFLOW_RELEASE_SIGNING_KEY_PEM or at $effectiveKeyPath."
+          }
+          if (-not $env:GITEA_TOKEN) {
+            throw "Gitea Actions did not provide GITEA_TOKEN to the release job."
+          }
+
+          & cmd.exe /d /s /c "npm ci --no-audit --no-fund"
+          if ($LASTEXITCODE -ne 0) { throw "npm ci failed." }
+          & cmd.exe /d /s /c "npx electron --version"
+          if ($LASTEXITCODE -ne 0) { throw "Electron preflight failed." }
+          & cmd.exe /d /s /c "npm run check"
+          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow release quality gate failed." }
+          & cmd.exe /d /s /c "npm run dist:win"
+          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Windows build/signing failed." }
+          & cmd.exe /d /s /c "npm run release:binary"
+          if ($LASTEXITCODE -ne 0) { throw "ForgeFlow Gitea release publication failed." }
+
+          Write-Host "ForgeFlow $version was built, signed and published from exact main HEAD $env:GITEA_SHA."