diff --git a/.forgejo/workflows/main.yaml b/.forgejo/workflows/main.yaml
index ca34650..45dee0d 100644
--- a/.forgejo/workflows/main.yaml
+++ b/.forgejo/workflows/main.yaml
@@ -4,15 +4,6 @@ on:
   workflow_dispatch:
 
 jobs:
-  fmt:
-    runs-on: 'self-hosted'
-    steps:
-      - uses: 'actions/checkout@v4'
-      - uses: 'actions/setup-go@v5'
-        with:
-          go-version-file: 'go.mod'
-      - run: |
-          make tidy no-dirty
   test:
     runs-on: 'self-hosted'
     steps:
@@ -20,5 +11,63 @@ jobs:
       - uses: 'actions/setup-go@v5'
         with:
           go-version-file: 'go.mod'
-      - run: |
+      - name: 'fmt'
+        run: |
+          make tidy no-dirty
+      - name: 'check'
+        run: |
           make check tidy no-dirty
+  build:
+    if: "${{ startsWith(github.ref, 'refs/tags/') }}"
+    needs:
+      - 'test'
+    runs-on: 'self-hosted'
+    steps:
+      - uses: 'actions/checkout@v4'
+      - uses: 'actions/setup-go@v5'
+        with:
+          go-version-file: 'go.mod'
+      - name: 'build'
+        run: |
+          printf '%s' "$GIT_CRYPT_SECRET" | base64 -d > secret
+          git-crypt unlock secret
+          make build
+        env:
+          GIT_CRYPT_SECRET: '${{ secrets.GIT_CRYPT }}'
+      - uses: 'actions/upload-artifact@v3'
+        with:
+          if-no-files-found: 'error'
+          name: 'ods'
+          path: 'ods'
+  deploy:
+    needs:
+      - 'build'
+    runs-on: 'self-hosted'
+    steps:
+      - uses: 'actions/download-artifact@v3'
+        with:
+          name: 'ods'
+      - run: |
+          printf '%s' "$SSH_PRIVATE_KEY" > private_key
+          SSHOPTS="-i private_key -o StrictHostKeyChecking=accept-new"
+          rsync -e "ssh ${SSHOPTS}" ods root@ods.adyxax.org:/usr/local/bin/
+          ssh ${SSHOPTS} root@ods.adyxax.org "systemctl restart ods"
+        env:
+          SSH_PRIVATE_KEY: '${{ secrets.SSH_PRIVATE_KEY }}'
+  publish:
+    needs:
+      - 'build'
+    runs-on: 'self-hosted'
+    steps:
+      - uses: 'actions/download-artifact@v3'
+        with:
+          name: 'ods'
+      - uses: 'actions/forgejo-release@v2'
+        with:
+          direction: 'upload'
+          tag: '${{ github.ref_name }}'
+          sha: '${{ github.sha }}'
+          release-dir: './'
+          token: '${{ env.GITHUB_TOKEN }}'
+          hide-archive-link: true
+          release-notes-assistant: true