diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..9417b24
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,89 @@
+name: Release Image
+
+# Baut das Container-Image und haengt es als .tar.gz an den Release.
+# Ablauf: in Gitea einen Release (Tag z.B. v0.1.0) veroeffentlichen ->
+# dieser Workflow baut das Image, `docker save`t es und laedt es als Asset
+# an genau diesen Release. Download = simpler HTTPS-GET -> auf dem Laptop
+# `podman load < dtrack-mcp-<tag>.tar.gz`.
+#
+# Spiegelt den bewaehrten Godforge/deploy.yml-Stil (host-Runner, docker-cli,
+# curl+jq gegen die Gitea-API mit secrets.GITEATOKEN).
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release-Tag (z.B. v0.1.0) -- der Release muss bereits existieren"
+        required: true
+
+jobs:
+  build-and-attach:
+    runs-on: host
+
+    steps:
+      - name: Install deps
+        run: apk add --no-cache curl jq docker-cli git
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve tag
+        id: vars
+        run: |
+          if [ "${{ gitea.event_name }}" = "release" ]; then
+            echo "tag=${{ gitea.ref_name }}" >> $GITHUB_OUTPUT
+          else
+            echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build image
+        run: |
+          TAG="${{ steps.vars.outputs.tag }}"
+          docker build -f Containerfile -t "dtrack-mcp:${TAG}" .
+
+      - name: Save image as tarball
+        run: |
+          TAG="${{ steps.vars.outputs.tag }}"
+          docker save "dtrack-mcp:${TAG}" | gzip > "dtrack-mcp-${TAG}.tar.gz"
+          ls -lh "dtrack-mcp-${TAG}.tar.gz"
+
+      - name: Attach tarball to release
+        run: |
+          TAG="${{ steps.vars.outputs.tag }}"
+          FILE="dtrack-mcp-${TAG}.tar.gz"
+          REPO="${{ gitea.repository }}"
+
+          REL_ID=$(curl -s \
+            "https://git.sithies.de/api/v1/repos/${REPO}/releases/tags/${TAG}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
+            | jq -r '.id')
+
+          if [ -z "$REL_ID" ] || [ "$REL_ID" = "null" ]; then
+            echo "ERROR: Kein Release fuer Tag ${TAG} gefunden. Erst Release veroeffentlichen."
+            exit 1
+          fi
+
+          # Vorhandenes Asset gleichen Namens entfernen (idempotente Re-Runs).
+          OLD_ID=$(curl -s \
+            "https://git.sithies.de/api/v1/repos/${REPO}/releases/${REL_ID}/assets" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
+            | jq -r --arg n "$FILE" '.[] | select(.name == $n) | .id')
+          if [ -n "$OLD_ID" ] && [ "$OLD_ID" != "null" ]; then
+            curl -s -X DELETE \
+              "https://git.sithies.de/api/v1/repos/${REPO}/releases/${REL_ID}/assets/${OLD_ID}" \
+              -H "Authorization: token ${{ secrets.GITEATOKEN }}"
+          fi
+
+          curl -sf -X POST \
+            "https://git.sithies.de/api/v1/repos/${REPO}/releases/${REL_ID}/assets?name=${FILE}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
+            -F "attachment=@${FILE}" \
+            && echo "Asset ${FILE} an Release ${TAG} angehaengt."
+
+      - name: Cleanup
+        if: always()
+        run: |
+          docker image rm "dtrack-mcp:${{ steps.vars.outputs.tag }}" 2>/dev/null || true
+          apk del jq 2>/dev/null || true