diff --git a/.github/workflows/ci.yml b/.gitea/workflows/ci.yml
similarity index 96%
rename from .github/workflows/ci.yml
rename to .gitea/workflows/ci.yml
index fc164cc..9a704bb 100644
--- a/.github/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   lint-and-test:
     name: Lint + build + test
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/e2e.yml b/.gitea/workflows/e2e.yml
similarity index 89%
rename from .github/workflows/e2e.yml
rename to .gitea/workflows/e2e.yml
index 0e93158..4a09df3 100644
--- a/.github/workflows/e2e.yml
+++ b/.gitea/workflows/e2e.yml
@@ -2,8 +2,9 @@ name: E2E (manual)
 
 # The E2E job builds the live image (mkosi, requires apt package
 # updates) and boots a QEMU VM against a running orchestrator. It's
-# slow and needs a Linux runner with nested virtualization, so it runs
-# only on workflow_dispatch.
+# slow and needs a Linux runner with nested virtualization + loop
+# devices, so it runs only on workflow_dispatch against the privileged
+# self-hosted runner.
 
 on:
   workflow_dispatch:
@@ -18,7 +19,7 @@ permissions:
 
 jobs:
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..ca1c12c
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,76 @@
+name: Release
+
+# Builds the full release tarball (orchestrator + agent + live image +
+# deploy scripts) and publishes it to the Gitea generic package
+# registry under two versions:
+#   - sha-<short-sha>  immutable, per-commit pin
+#   - latest           rolling alias (DELETE+PUT on each run)
+#
+# The LXC installer (deploy/proxmox-install.sh) curls the "latest"
+# version by default; operators can pin via VETTING_VERSION=sha-abc1234.
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: self-hosted
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.26.x"
+          cache: true
+
+      - name: Install live-image build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            mkosi debootstrap squashfs-tools dosfstools
+
+      - name: Install templ
+        run: go install github.com/a-h/templ/cmd/templ@v0.3.1001
+
+      - name: Build release bundle
+        run: make release
+
+      - name: Resolve bundle path + short sha
+        id: meta
+        run: |
+          short_sha=$(git rev-parse --short HEAD)
+          echo "short_sha=${short_sha}" >> "$GITHUB_OUTPUT"
+          echo "bundle=bin/vetting-bundle-${short_sha}.tar.gz" >> "$GITHUB_OUTPUT"
+
+      - name: Publish sha-pinned bundle
+        env:
+          REGISTRY_URL:   ${{ vars.REGISTRY_URL }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          OWNER:          ${{ gitea.repository_owner }}
+          SHORT_SHA:      ${{ steps.meta.outputs.short_sha }}
+          BUNDLE:         ${{ steps.meta.outputs.bundle }}
+        run: |
+          curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
+            --upload-file "${BUNDLE}" \
+            "${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/sha-${SHORT_SHA}/vetting-bundle.tar.gz"
+
+      - name: Replace latest alias
+        env:
+          REGISTRY_URL:   ${{ vars.REGISTRY_URL }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          OWNER:          ${{ gitea.repository_owner }}
+          BUNDLE:         ${{ steps.meta.outputs.bundle }}
+        run: |
+          curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
+            -X DELETE \
+            "${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest/vetting-bundle.tar.gz" \
+            || true
+          curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
+            --upload-file "${BUNDLE}" \
+            "${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest/vetting-bundle.tar.gz"