diff --git a/.gitea/workflows/debian-build.yml b/.gitea/workflows/debian-build.yml
index 65bf425..c39f6a8 100644
--- a/.gitea/workflows/debian-build.yml
+++ b/.gitea/workflows/debian-build.yml
@@ -2,8 +2,7 @@ name: Build Debian Packages
 
 on:
   push:
-    branches: [ "main" ]
-  pull_request:
+    tags: [ "v*" ]        # releases are tag-driven now
   workflow_dispatch:
 
 jobs:
@@ -16,14 +15,14 @@ jobs:
             codename: bookworm
           - target: debian13
             codename: trixie
-    
+
     runs-on: ${{ matrix.target }}
 
     steps:
       - name: Install Node.js and git
         run: |
           apt-get update
-          apt-get -y install nodejs git lsb-release
+          apt-get -y install nodejs git lsb-release jq
 
       - name: Checkout repository
         uses: actions/checkout@v3
@@ -31,20 +30,61 @@ jobs:
           github-server-url: https://gitea.pkm.physik.tu-darmstadt.de
 
       - name: Install build dependencies
-        run: |
-          bash requirements.debian
+        run: bash requirements.debian
 
       - name: Build Package
-        run: |
-          dpkg-buildpackage -us -uc -b
+        run: dpkg-buildpackage -us -uc -b
 
       - name: Collect Artifacts
         run: |
           mkdir -p artifacts
           mv -v ../*.deb artifacts/
 
-      - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: python3-damaris-${{ matrix.codename }}.gz
-          path: artifacts/*.deb
+      - name: Publish release with assets
+        env:
+          GITEA_TOKEN: ${{ secrets.DEB_UPLOAD_TOKEN }}
+          SLUG: ${{ gitea.repository }}          # owner/repo
+          TAG: ${{ gitea.ref_name }}             # e.g. v1.2.3
+          CODENAME: ${{ matrix.codename }}
+        run: |
+          set -euo pipefail
+          API="https://gitea.pkm.physik.tu-darmstadt.de/api/v1"
+          AUTH="Authorization: token ${GITEA_TOKEN}"
+
+          # 1. Find an existing release for this tag, if any
+          release_id=$(curl -s -H "$AUTH" \
+            "$API/repos/$SLUG/releases/tags/$TAG" | jq -r '.id // empty')
+
+          # 2. Create the release if it does not exist yet
+          if [ -z "$release_id" ]; then
+            echo "Creating release $TAG"
+            release_id=$(curl -s -X POST -H "$AUTH" \
+              -H "Content-Type: application/json" \
+              -d "$(jq -n --arg tag "$TAG" \
+                    '{tag_name:$tag, name:$tag, draft:false, prerelease:false}')" \
+              "$API/repos/$SLUG/releases" | jq -r '.id')
+          else
+            echo "Reusing existing release $TAG (id=$release_id)"
+          fi
+          echo "release_id=$release_id"
+
+          # 3. Upload each .deb as an asset
+          for deb in artifacts/*.deb; do
+            asset="${CODENAME}_$(basename "$deb")"   # avoid bookworm/trixie name clash
+            echo "Uploading $asset"
+
+            # delete any existing asset with the same name (idempotent re-runs)
+            existing=$(curl -s -H "$AUTH" \
+              "$API/repos/$SLUG/releases/$release_id/assets" \
+              | jq -r --arg n "$asset" '.[] | select(.name==$n) | .id')
+            if [ -n "$existing" ]; then
+              curl -s -X DELETE -H "$AUTH" \
+                "$API/repos/$SLUG/releases/$release_id/assets/$existing"
+            fi
+
+            curl --fail --show-error --silent \
+              -X POST -H "$AUTH" \
+              -F "attachment=@$deb;filename=$asset" \
+              "$API/repos/$SLUG/releases/$release_id/assets"
+          done
+