diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
new file mode 100644
index 00000000..66ec2587
--- /dev/null
+++ b/.forgejo/workflows/release.yml
@@ -0,0 +1,60 @@
+name: release
+
+# Builds and pushes the minstrel container image to the Forgejo registry.
+#
+#   push to main         → :main
+#   push tag vX.Y.Z      → :vX.Y.Z and :latest
+#
+# No-ops cleanly until the server skeleton (go.mod + Dockerfile) lands.
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+
+jobs:
+  release:
+    runs-on: go-ci
+
+    env:
+      IMAGE: git.fabledsword.com/bvandeusen/minstrel
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect buildable project
+        id: guard
+        shell: bash
+        run: |
+          if [ -f Dockerfile ] && [ -f go.mod ]; then
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::No Dockerfile + go.mod yet — release build skipped"
+          fi
+
+      - name: Compute image tags
+        id: tags
+        if: steps.guard.outputs.ready == 'true'
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            VERSION="${GITHUB_REF#refs/tags/}"
+            echo "args=-t ${IMAGE}:${VERSION} -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+            echo "::notice::Release build: ${VERSION} + latest"
+          else
+            echo "args=-t ${IMAGE}:main" >> "$GITHUB_OUTPUT"
+            echo "::notice::Main-branch build: :main"
+          fi
+
+      - name: Registry login
+        if: steps.guard.outputs.ready == 'true'
+        shell: bash
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" \
+            | docker login git.fabledsword.com -u "${{ github.actor }}" --password-stdin
+
+      - name: Build and push
+        if: steps.guard.outputs.ready == 'true'
+        run: docker buildx build --push ${{ steps.tags.outputs.args }} .