diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 08bee5c..8b4e0ec 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -1,15 +1,98 @@
-name: Build Test
+name: Build and Release Ody Agent
 
 on:
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version tag (e.g. v1.0.0)'
+        required: false
+        default: 'dev'
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - name: Check environment
+      - name: Checkout source
         run: |
-          echo "Hello from Hetzner CI!"
-          uname -a
-          go version || echo "go not installed"
-          ls /usr/local/go/bin/ || echo "no go dir"
+          git clone --depth=1 \
+            "https://git.wellspr.ing/wellspring/ody-agent.git" /workspace
+          cd /workspace && git log --oneline -3
+
+      - name: Install Go 1.22
+        run: |
+          curl -fsSL https://go.dev/dl/go1.22.3.linux-amd64.tar.gz \
+            -o /tmp/go.tar.gz
+          tar -C /usr/local -xzf /tmp/go.tar.gz
+          echo "Go installed: $(/usr/local/go/bin/go version)"
+
+      - name: Build all platforms
+        run: |
+          export PATH="/usr/local/go/bin:$PATH"
+          cd /workspace
+          mkdir -p dist
+          echo "Building Windows..."
+          GOOS=windows GOARCH=amd64 CGO_ENABLED=0 \
+            go build -ldflags "-s -w -H=windowsgui -X main.defaultServer=https://425.today" \
+            -o dist/ody-agent-win.exe .
+          echo "Building macOS ARM64..."
+          GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 \
+            go build -ldflags "-s -w -X main.defaultServer=https://425.today" \
+            -o dist/ody-agent-mac-arm64 .
+          echo "Building macOS AMD64..."
+          GOOS=darwin GOARCH=amd64 CGO_ENABLED=0 \
+            go build -ldflags "-s -w -X main.defaultServer=https://425.today" \
+            -o dist/ody-agent-mac-amd64 .
+          echo "Building Linux..."
+          GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
+            go build -ldflags "-s -w -X main.defaultServer=https://425.today" \
+            -o dist/ody-agent-linux .
+          echo "--- Artifacts ---"
+          ls -lh dist/
+
+      - name: Publish release to Forgejo
+        run: |
+          export PATH="/usr/local/go/bin:$PATH"
+          if [ "${{ github.event_name }}" = "push" ]; then
+            VERSION="${GITHUB_REF#refs/tags/}"
+          else
+            VERSION="${{ github.event.inputs.version }}"
+          fi
+          echo "Publishing release: $VERSION"
+          FORGEJO_URL="https://git.wellspr.ing"
+          TOKEN="${{ secrets.FORGEJO_TOKEN }}"
+          REPO="wellspring/ody-agent"
+
+          # Delete existing release for this tag if any
+          EXISTING=$(curl -sf "$FORGEJO_URL/api/v1/repos/$REPO/releases/tags/$VERSION" \
+            -H "Authorization: token $TOKEN" 2>/dev/null || echo "")
+          if [ -n "$EXISTING" ]; then
+            RID=$(echo "$EXISTING" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || echo "")
+            if [ -n "$RID" ]; then
+              curl -sf -X DELETE "$FORGEJO_URL/api/v1/repos/$REPO/releases/$RID" \
+                -H "Authorization: token $TOKEN" && echo "Deleted old release $RID"
+            fi
+          fi
+
+          # Create new release
+          BODY="### Ody Agent $VERSION\n\nDesktop agent for WellSpr.ing / NNN.today merchants.\n\n| Platform | File |\n|---|---|\n| Windows 64-bit | \`ody-agent-win.exe\` |\n| macOS Apple Silicon | \`ody-agent-mac-arm64\` |\n| macOS Intel | \`ody-agent-mac-amd64\` |\n| Linux 64-bit | \`ody-agent-linux\` |"
+          RELEASE=$(curl -sf -X POST "$FORGEJO_URL/api/v1/repos/$REPO/releases" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$VERSION\",\"name\":\"Ody Agent $VERSION\",\"body\":\"$BODY\",\"draft\":false}")
+          RELEASE_ID=$(echo "$RELEASE" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
+          echo "Created release ID: $RELEASE_ID"
+
+          for f in /workspace/dist/*; do
+            FNAME=$(basename "$f")
+            echo "Uploading $FNAME..."
+            curl -sf -X POST \
+              "$FORGEJO_URL/api/v1/repos/$REPO/releases/$RELEASE_ID/assets?name=$FNAME" \
+              -H "Authorization: token $TOKEN" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@$f"
+            echo "$FNAME uploaded."
+          done
+          echo "Done: $FORGEJO_URL/$REPO/releases/tag/$VERSION"