diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..19e7dcb
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,25 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Run tests
+        run: cargo test --all
+
+      - name: Build release
+        run: cargo build --release
+
+      - name: Run shell decoder tests
+        run: bash shell/test_decoder.sh
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..99ded4e
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,121 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-musl
+            artifact: encrypted_archive-linux-amd64
+          - target: aarch64-unknown-linux-musl
+            artifact: encrypted_archive-linux-arm64
+          - target: x86_64-pc-windows-gnu
+            artifact: encrypted_archive-windows-amd64.exe
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cross
+        run: cargo install cross --git https://github.com/cross-rs/cross
+
+      - name: Build release binary
+        run: cross build --release --target ${{ matrix.target }}
+
+      - name: Rename binary
+        run: |
+          src="target/${{ matrix.target }}/release/encrypted_archive"
+          if [ "${{ matrix.target }}" = "x86_64-pc-windows-gnu" ]; then
+            src="${src}.exe"
+          fi
+          cp "$src" "${{ matrix.artifact }}"
+
+      - name: Generate SHA-256
+        run: sha256sum "${{ matrix.artifact }}" > "${{ matrix.artifact }}.sha256"
+
+      - name: Upload artifact
+        uses: https://gitea.com/actions/upload-artifact@v3
+        with:
+          name: ${{ matrix.artifact }}
+          path: |
+            ${{ matrix.artifact }}
+            ${{ matrix.artifact }}.sha256
+
+  package-decoders:
+    name: Package decoders
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Package shell decoder
+        run: |
+          cp shell/decode.sh decode.sh
+          sha256sum decode.sh > decode.sh.sha256
+
+      - name: Package Kotlin decoder
+        run: |
+          cp kotlin/ArchiveDecoder.kt ArchiveDecoder.kt
+          sha256sum ArchiveDecoder.kt > ArchiveDecoder.kt.sha256
+
+      - name: Upload shell decoder
+        uses: https://gitea.com/actions/upload-artifact@v3
+        with:
+          name: decode.sh
+          path: |
+            decode.sh
+            decode.sh.sha256
+
+      - name: Upload Kotlin decoder
+        uses: https://gitea.com/actions/upload-artifact@v3
+        with:
+          name: ArchiveDecoder.kt
+          path: |
+            ArchiveDecoder.kt
+            ArchiveDecoder.kt.sha256
+
+  release:
+    name: Create release
+    needs: [build, package-decoders]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: https://gitea.com/actions/download-artifact@v3
+        with:
+          path: artifacts/
+
+      - name: Collect release files
+        run: |
+          mkdir -p release
+          find artifacts/ -type f -exec cp {} release/ \;
+          ls -la release/
+
+      - name: Create release
+        uses: https://gitea.com/actions/gitea-release-action@v1
+        with:
+          files: release/*
+          sha256sum: false
+          body: |
+            ## encrypted_archive ${{ gitea.ref_name }}
+
+            ### Artifacts
+
+            | File | Description |
+            |------|-------------|
+            | `encrypted_archive-linux-amd64` | Linux x86_64 (static musl) |
+            | `encrypted_archive-linux-arm64` | Linux aarch64 (static musl) |
+            | `encrypted_archive-windows-amd64.exe` | Windows x86_64 |
+            | `ArchiveDecoder.kt` | Kotlin/Android decoder (source) |
+            | `decode.sh` | POSIX shell decoder (requires OpenSSL) |
+
+            Each binary has a corresponding `.sha256` checksum file.