diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..8eb2e89
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,41 @@
+# Host-mode runner: Go via official image.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: tarakan-client-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Test, vet, build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: Go check
+        run: |
+          set -euo pipefail
+          case "$GITHUB_WORKSPACE" in
+            /data/*) HOST_WORKSPACE="/opt/forgejo-runner/data${GITHUB_WORKSPACE#/data}" ;;
+            *) HOST_WORKSPACE="$GITHUB_WORKSPACE" ;;
+          esac
+          test -f "$GITHUB_WORKSPACE/go.mod"
+          docker run --rm --network host \
+            --volume "$HOST_WORKSPACE:/src" \
+            --workdir /src \
+            -e CGO_ENABLED=0 \
+            golang:1.25-bookworm \
+            bash -lc '
+              set -euo pipefail
+              go version
+              go test -count=1 ./...
+              go vet ./...
+              make build
+              ls -la bin/tarakan
+            '
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
new file mode 100644
index 0000000..0a0afab
--- /dev/null
+++ b/.forgejo/workflows/release.yml
@@ -0,0 +1,107 @@
+# Multi-arch binaries + Forgejo release on tags v*.
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+concurrency:
+  group: tarakan-client-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Build and publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: Build multi-arch archives
+        run: |
+          set -euo pipefail
+          case "$GITHUB_WORKSPACE" in
+            /data/*) HOST_WORKSPACE="/opt/forgejo-runner/data${GITHUB_WORKSPACE#/data}" ;;
+            *) HOST_WORKSPACE="$GITHUB_WORKSPACE" ;;
+          esac
+          version="${GITHUB_REF_NAME//\//-}"
+          docker run --rm --network host \
+            --volume "$HOST_WORKSPACE:/src" \
+            --workdir /src \
+            -e CGO_ENABLED=0 \
+            -e VERSION="$version" \
+            golang:1.25-bookworm \
+            bash -lc '
+              set -euo pipefail
+              apt-get update -qq
+              apt-get install -y -qq zip >/dev/null
+              go test -count=1 ./...
+              go vet ./...
+
+              version="${VERSION}"
+              mkdir -p dist staging
+              targets=(
+                "linux amd64"
+                "linux arm64"
+                "darwin amd64"
+                "darwin arm64"
+                "windows amd64"
+                "windows arm64"
+              )
+              for target in "${targets[@]}"; do
+                read -r goos goarch <<< "${target}"
+                archive="tarakan_${version}_${goos}_${goarch}"
+                package="staging/${archive}"
+                mkdir -p "${package}"
+                binary="tarakan"
+                if [[ "${goos}" == "windows" ]]; then
+                  binary="tarakan.exe"
+                fi
+                version_ld="${version#v}"
+                CGO_ENABLED=0 GOOS="${goos}" GOARCH="${goarch}" \
+                  go build -trimpath -ldflags="-s -w -X main.version=${version_ld}" \
+                  -o "${package}/${binary}" ./cmd/tarakan
+                cp LICENSE "${package}/"
+                if [[ "${goos}" == "windows" ]]; then
+                  (cd staging && zip -q -r "../dist/${archive}.zip" "${archive}")
+                else
+                  tar -C staging -czf "dist/${archive}.tar.gz" "${archive}"
+                fi
+              done
+              (cd dist && sha256sum tarakan_* > checksums.txt)
+              ls -la dist/
+            '
+
+      - name: Publish Forgejo release
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN || github.token }}
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME}"
+          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"
+          body=$(printf '%s' "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\",\"draft\":false,\"prerelease\":false}")
+          resp=$(curl -sS -w "\n%{http_code}" -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$body" "$api" || true)
+          code=$(printf '%s' "$resp" | tail -n1)
+          payload=$(printf '%s' "$resp" | sed '$d')
+          if [[ "$code" != "201" && "$code" != "200" ]]; then
+            payload=$(curl -sS -H "Authorization: token ${TOKEN}" \
+              "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/tags/${tag}")
+          fi
+          id=$(printf '%s' "$payload" | python3 -c 'import sys,json; print(json.load(sys.stdin)["id"])')
+          echo "release id=$id"
+          for f in dist/*; do
+            [ -f "$f" ] || continue
+            name=$(basename "$f")
+            echo "uploading $name"
+            curl -sS -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary @"$f" \
+              "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/${id}/assets?name=${name}" \
+              | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("name"), d.get("browser_download_url") or d.get("message"))'
+          done