diff --git a/.woodpecker/release.yml b/.woodpecker/release.yml
new file mode 100644
index 0000000..187931f
--- /dev/null
+++ b/.woodpecker/release.yml
@@ -0,0 +1,41 @@
+# Release pipeline — runs when a vX.Y.Z tag is pushed.
+#
+# Builds gnoma via GoReleaser:
+#   - static binaries for linux/darwin/windows × amd64/arm64
+#   - archives + checksums + changelog uploaded to the GitHub mirror's
+#     releases page (via the GoReleaser github backend in .goreleaser.yml)
+#   - multi-arch container images pushed to ghcr.io/vikingowl91/gnoma
+#
+# Secrets required (set in Woodpecker repo settings):
+#   github_token   GitHub PAT with `repo` + `write:packages` scopes.
+#                  Used for both the release upload and the ghcr.io
+#                  image push.
+#
+# Runner requirements:
+#   - Docker socket access (mounted via volumes below).
+#   - QEMU registered on the host for arm64 cross-builds. One-time:
+#       docker run --privileged --rm tonistiigi/binfmt --install all
+#     If your Woodpecker host doesn't have it and you can't grant
+#     privileged, drop arm64 from .goreleaser.yml or run releases
+#     manually until a runner with QEMU is available.
+
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+steps:
+  - name: test
+    image: golang:1.26
+    commands:
+      - go test ./...
+
+  - name: release
+    image: goreleaser/goreleaser:latest
+    environment:
+      GITHUB_TOKEN:
+        from_secret: github_token
+    commands:
+      - echo "$GITHUB_TOKEN" | docker login ghcr.io -u VikingOwl91 --password-stdin
+      - goreleaser release --clean
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock