diff --git a/.github/workflows/release-deb.yml b/.github/workflows/release-deb.yml
new file mode 100644
index 0000000..81d038a
--- /dev/null
+++ b/.github/workflows/release-deb.yml
@@ -0,0 +1,102 @@
+name: Release archive
+
+permissions:
+  contents: write
+  packages: write
+
+on:
+  release:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to attach assets to (e.g. 1.0.0)'
+        required: false
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Install apt deps (jq/zip + dev-libs)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            zip jq \
+            libpipewire-0.3-dev \
+            libclang-dev \
+            libasound2-dev
+
+      - name: Determine tag to use
+        id: tag
+        run: |
+          set -euo pipefail
+
+          INPUT_TAG="${{ github.event.inputs.tag || '' }}"
+          if [ -n "$INPUT_TAG" ]; then
+            echo "Using input tag: $INPUT_TAG"
+            echo "tag=$INPUT_TAG" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          EVENT_TAG="${{ github.event.release.tag_name || '' }}"
+          if [ -n "$EVENT_TAG" ]; then
+            echo "Using event tag: $EVENT_TAG"
+            echo "tag=$EVENT_TAG" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          if [[ "${GITHUB_REF:-}" =~ ^refs/tags/(.+)$ ]]; then
+            echo "Using GITHUB_REF tag: ${BASH_REMATCH[1]}"
+            echo "tag=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          echo "No tag in input/event/GITHUB_REF — querying latest release via API..."
+          LATEST_JSON=$(curl -sSf -H "Authorization: Bearer $GITHUB_TOKEN" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/${{ github.repository }}/releases/latest" || true)
+          TAG_NAME=$(echo "$LATEST_JSON" | jq -r '.tag_name // empty')
+          if [ -n "$TAG_NAME" ]; then
+            echo "Found latest release tag: $TAG_NAME"
+            echo "tag=$TAG_NAME" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          echo "No tag found"
+          echo "tag=" >> $GITHUB_OUTPUT
+
+      - name: Fail if no tag determined
+        if: ${{ steps.tag.outputs.tag == '' }}
+        run: |
+          echo "ERROR: No tag determined. Provide a tag when running manually or ensure a release exists."
+          exit 1
+
+      - name: Checkout code at tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.tag.outputs.tag || github.ref }}
+          fetch-depth: 0
+
+      - name: Setup Rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: Build all release binaries
+        run: cargo build --release --locked
+
+      - name: Install cargo-deb and create .deb
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo install --locked cargo-deb
+          export PATH="$HOME/.cargo/bin:$PATH"
+
+          cargo-deb
+
+      - name: Upload release archive
+        uses: softprops/action-gh-release@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          tag_name: ${{ steps.tag.outputs.tag }}
+          files: |
+            *.zip