diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index d0b130b..b7f4410 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -3,7 +3,8 @@ name: Build
 on:
   push:
     branches: [main]
-    tags: ["v*"]
+    # Release tags, e.g. 1.0, 1.2.3 or v1.0
+    tags: ["v[0-9]*", "[0-9]*"]
   pull_request:
   workflow_dispatch:
 
@@ -15,6 +16,9 @@ jobs:
       PROJECT: proxy studio.xcodeproj
       TARGET: proxy studio
       APP_NAME: Proxy Studio
+    defaults:
+      run:
+        shell: bash
     steps:
       - uses: actions/checkout@v4
 
@@ -23,9 +27,25 @@ jobs:
           xcode-select -p
           xcodebuild -version
 
+      - name: Determine version
+        run: |
+          if [ "$GITHUB_REF_TYPE" = "tag" ]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            VERSION="0.0.0-${GITHUB_SHA::7}"
+          fi
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
+          echo "ZIP_NAME=ProxyStudio-$VERSION.zip" >> "$GITHUB_ENV"
+          echo "Version: $VERSION"
+
       - name: Build
         run: |
           set -o pipefail
+          # MARKETING_VERSION only accepts dotted numbers, so dev builds keep the project default.
+          VERSION_SETTINGS=()
+          if [ "$GITHUB_REF_TYPE" = "tag" ]; then
+            VERSION_SETTINGS+=(MARKETING_VERSION="$VERSION")
+          fi
           xcodebuild build \
             -project "$PROJECT" \
             -target "$TARGET" \
@@ -34,17 +54,48 @@ jobs:
             CODE_SIGN_STYLE=Manual \
             CODE_SIGN_IDENTITY=- \
             DEVELOPMENT_TEAM= \
+            CURRENT_PROJECT_VERSION="$GITHUB_RUN_NUMBER" \
+            "${VERSION_SETTINGS[@]}" \
             | tee xcodebuild.log
 
       - name: Package
         run: |
           cd build/Release
-          ditto -c -k --keepParent "$APP_NAME.app" "$GITHUB_WORKSPACE/ProxyStudio.zip"
+          ditto -c -k --keepParent "$APP_NAME.app" "$GITHUB_WORKSPACE/$ZIP_NAME"
 
       - uses: actions/upload-artifact@v4
         with:
-          name: ProxyStudio-${{ github.sha }}
-          path: ProxyStudio.zip
+          name: ProxyStudio-${{ env.VERSION }}
+          path: ${{ env.ZIP_NAME }}
+
+      - name: Publish release
+        if: github.ref_type == 'tag'
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: |
+          set -euo pipefail
+          auth=(-H "Authorization: token $TOKEN")
+
+          # Reuse the release if it was created in the Gitea UI, otherwise create it.
+          release_id=$(curl -sf "${auth[@]}" "$API/releases/tags/$GITHUB_REF_NAME" | jq -r .id || true)
+          if [ -z "$release_id" ] || [ "$release_id" = "null" ]; then
+            release_id=$(curl -sf "${auth[@]}" -H "Content-Type: application/json" \
+              -d "$(jq -n --arg tag "$GITHUB_REF_NAME" --arg name "$APP_NAME $VERSION" \
+                    '{tag_name: $tag, name: $name}')" \
+              "$API/releases" | jq -r .id)
+          fi
+
+          # Replace an existing asset of the same name (e.g. when re-running the job).
+          existing=$(curl -sf "${auth[@]}" "$API/releases/$release_id/assets" \
+            | jq -r --arg n "$ZIP_NAME" '.[] | select(.name == $n) | .id')
+          for id in $existing; do
+            curl -sf -X DELETE "${auth[@]}" "$API/releases/$release_id/assets/$id"
+          done
+
+          curl -sf "${auth[@]}" -F "attachment=@$ZIP_NAME" \
+            "$API/releases/$release_id/assets?name=$ZIP_NAME" > /dev/null
+          echo "Uploaded $ZIP_NAME to release $GITHUB_REF_NAME"
 
       - uses: actions/upload-artifact@v4
         if: failure()