diff --git a/.forgejo/workflows/beta-release.yml b/.forgejo/workflows/beta-release.yml
index 7e19e78..7eb12ca 100644
--- a/.forgejo/workflows/beta-release.yml
+++ b/.forgejo/workflows/beta-release.yml
@@ -54,6 +54,7 @@ jobs:
           sha256sum "${PKG_DIR}/breadcrumbs-x86_64" | awk '{print $1}' \
             > "${PKG_DIR}/breadcrumbs-x86_64.sha256"
           cp src/breadcrumbs.example.toml "${PKG_DIR}/"
+          cp src/LICENSE "${PKG_DIR}/"
           cp src/bakery.toml "${PKG_DIR}/bakery.toml"
           ln -sfn "${VERSION}" "/srv/breadway-dl/beta/breadcrumbs/latest"
 
diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
index e2f54c5..c2da0cf 100644
--- a/.forgejo/workflows/dev-release.yml
+++ b/.forgejo/workflows/dev-release.yml
@@ -54,6 +54,7 @@ jobs:
           sha256sum "${PKG_DIR}/breadcrumbs-x86_64" | awk '{print $1}' \
             > "${PKG_DIR}/breadcrumbs-x86_64.sha256"
           cp src/breadcrumbs.example.toml "${PKG_DIR}/"
+          cp src/LICENSE "${PKG_DIR}/"
           cp src/bakery.toml "${PKG_DIR}/bakery.toml"
           ln -sfn "${VERSION}" "/srv/breadway-dl/dev/breadcrumbs/latest"
 
diff --git a/.forgejo/workflows/package.yml b/.forgejo/workflows/package.yml
deleted file mode 100644
index 1b86c83..0000000
--- a/.forgejo/workflows/package.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: Build and publish package
-
-on:
-  push:
-    tags: ['v*']
-
-jobs:
-  package:
-    runs-on: [self-hosted, hestia]
-    container:
-      image: archlinux:latest
-    steps:
-      # Note: no actions/checkout — the archlinux image has no Node, which JS
-      # actions require. Everything runs as shell steps and clones manually.
-      - name: Build and publish
-        env:
-          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          set -euo pipefail
-          VERSION="${GITHUB_REF_NAME#v}"
-          pacman -Syu --noconfirm base-devel git rust cargo networkmanager
-          useradd -m builder
-          git config --global --add safe.directory '*'
-          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
-            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
-          cd /home/builder/src
-          git archive --format=tar.gz --prefix="breadcrumbs-${VERSION}/" HEAD \
-            > packaging/arch/breadcrumbs-${VERSION}.tar.gz
-          SHA=$(sha256sum packaging/arch/breadcrumbs-${VERSION}.tar.gz | awk '{print $1}')
-          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/arch/PKGBUILD
-          sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" packaging/arch/PKGBUILD
-          chown -R builder:builder /home/builder/src
-          # --nocheck: packaging builds the artifact; tests belong in a CI job.
-          su builder -c "cd /home/builder/src/packaging/arch && makepkg -f --noconfirm --nocheck"
-          PKG=$(find /home/builder/src/packaging/arch -name '*.pkg.tar.zst' | head -1)
-          curl -fsS -X PUT \
-            -H "Authorization: token ${PUBLISH_TOKEN}" \
-            -H "Content-Type: application/octet-stream" \
-            --data-binary "@${PKG}" \
-            "https://git.breadway.dev/api/packages/Breadway/arch/os"
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
new file mode 100644
index 0000000..445234e
--- /dev/null
+++ b/.forgejo/workflows/release.yml
@@ -0,0 +1,59 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: checkout
+        run: |
+          set -euo pipefail
+          rm -rf src && mkdir src
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: build
+        run: cd src && cargo build --release --locked
+
+      - name: test
+        run: cd src && cargo test --release --locked
+
+      - name: prepare artifacts
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          PKG_DIR="/srv/breadway-dl/breadcrumbs/${VERSION}"
+          mkdir -p "${PKG_DIR}"
+          cp src/target/release/breadcrumbs "${PKG_DIR}/breadcrumbs-x86_64"
+          strip "${PKG_DIR}/breadcrumbs-x86_64"
+          sha256sum "${PKG_DIR}/breadcrumbs-x86_64" | awk '{print $1}' \
+            > "${PKG_DIR}/breadcrumbs-x86_64.sha256"
+          cp src/breadcrumbs.example.toml "${PKG_DIR}/"
+          cp src/LICENSE "${PKG_DIR}/"
+          cp src/bakery.toml "${PKG_DIR}/bakery.toml"
+          cp src/contrib/breadcrumbs.service "${PKG_DIR}/"
+          ln -sfn "${VERSION}" "/srv/breadway-dl/breadcrumbs/latest"
+
+      - name: regenerate index.json
+        run: |
+          set -euo pipefail
+          rm -rf /tmp/bread-ecosystem-ci
+          git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
+          bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
+
+      - name: upload to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          PKG_DIR="/srv/breadway-dl/breadcrumbs/${VERSION}"
+          gh release create "${GITHUB_REF_NAME}" --repo Breadway/breadcrumbs \
+            --title "breadcrumbs v${VERSION}" --generate-notes 2>/dev/null || true
+          gh release upload "${GITHUB_REF_NAME}" --repo Breadway/breadcrumbs \
+            "${PKG_DIR}/breadcrumbs-x86_64" \
+            "${PKG_DIR}/breadcrumbs-x86_64.sha256" \
+            --clobber
diff --git a/bakery.toml b/bakery.toml
index d26fd8e..4e3a567 100644
--- a/bakery.toml
+++ b/bakery.toml
@@ -4,6 +4,7 @@ binaries = ["breadcrumbs"]
 system_deps = ["networkmanager"]
 optional_system_deps = ["tailscale", "sudo", "xdg-utils"]
 bread_deps = []
+license_file = "LICENSE"
 
 [config]
 dir = "~/.config/breadcrumbs"
diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
deleted file mode 100644
index 041d6c5..0000000
--- a/packaging/arch/PKGBUILD
+++ /dev/null
@@ -1,36 +0,0 @@
-# Maintainer: Breadway <rileyhorsham@gmail.com>
-
-pkgname=breadcrumbs
-pkgver=0.1.0
-pkgrel=1
-pkgdesc="Profile-aware Wi-Fi state machine with Tailscale integration"
-arch=('x86_64')
-url="https://github.com/Breadway/breadcrumbs"
-license=('MIT')
-# Some Rust deps (ring/mlua) build vendored C/asm into static archives; makepkg's
-# default -flto=auto emits GCC LTO bitcode the Rust (lld) link cannot read,
-# causing undefined-symbol errors. Disable LTO.
-options=(!lto !debug)
-depends=('networkmanager')
-optdepends=(
-  'tailscale: Tailscale VPN profile integration'
-)
-makedepends=('rust' 'cargo')
-source=("${pkgname}-${pkgver}.tar.gz")
-sha256sums=('SKIP')
-
-build() {
-  cd "${srcdir}/${pkgname}-${pkgver}"
-  cargo build --release --locked
-}
-
-check() {
-  cd "${srcdir}/${pkgname}-${pkgver}"
-  cargo test --release --locked
-}
-
-package() {
-  cd "${srcdir}/${pkgname}-${pkgver}"
-  install -Dm755 target/release/breadcrumbs "${pkgdir}/usr/bin/breadcrumbs"
-  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
-}