diff --git a/Cargo.toml b/Cargo.toml
index cacc953..294fe37 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -38,4 +38,4 @@ opt-level = 2
 codegen-units = 16
 incremental = true
 lto = false
-strip = false
+strip = "debuginfo"
diff --git a/Makefile b/Makefile
index 46d7173..d087187 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: build test fmt install package-release bench-report bench-local bench-local-json bench-docker-ssh bench-docker-mosh fuzz-smoke fuzz-deep soak-local tui-harness
+.PHONY: build test fmt install package-release publish-release bench-report bench-local bench-local-json bench-docker-ssh bench-docker-mosh fuzz-smoke fuzz-deep soak-local tui-harness
 
 build:
 	cargo build --release
@@ -15,6 +15,9 @@ install:
 package-release:
 	sh scripts/package-release.sh
 
+publish-release:
+	sh scripts/publish-gitea-release.sh
+
 bench-report:
 	sh scripts/bench-report.sh
 
diff --git a/scripts/publish-gitea-release.sh b/scripts/publish-gitea-release.sh
new file mode 100755
index 0000000..bc1204b
--- /dev/null
+++ b/scripts/publish-gitea-release.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env sh
+set -eu
+
+usage() {
+  cat <<'EOF'
+Usage:
+  scripts/publish-gitea-release.sh [TAG]
+
+Publishes the current Dosh release to Gitea.
+
+Defaults:
+  TAG                 v<Cargo.toml version>
+  DOSH_PUBLISH_BUILD 1: run scripts/package-release.sh first
+  DOSH_PUBLISH_PUSH  1: push TAG to origin
+  DOSH_PUBLISH_PRUNE 1: remove stale dosh-<version>-* duplicate assets
+
+Environment:
+  GITEA_URL, GITEA_REPO, GITEA_TOKEN: same as upload-gitea-release.sh
+  DOSH_PUBLISH_ALLOW_DIRTY=1          allow uncommitted changes
+EOF
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+repo_root="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
+cd "$repo_root"
+
+version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | sed -n '1p')"
+tag="${1:-v$version}"
+base="${GITEA_URL:-https://git.palav.dev}"
+repo="${GITEA_REPO:-Palav/dosh}"
+token="${GITEA_TOKEN:-}"
+build="${DOSH_PUBLISH_BUILD:-1}"
+push_tag="${DOSH_PUBLISH_PUSH:-1}"
+prune="${DOSH_PUBLISH_PRUNE:-1}"
+
+if [ -z "$token" ] && [ -f "$HOME/.config/dosh/gitea-token" ]; then
+  token="$(tr -d '\r\n' <"$HOME/.config/dosh/gitea-token")"
+fi
+
+need() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "missing required command: $1" >&2
+    exit 1
+  fi
+}
+
+need git
+need curl
+
+if [ "${DOSH_PUBLISH_ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
+  echo "refusing to publish with uncommitted changes" >&2
+  echo "commit first, or set DOSH_PUBLISH_ALLOW_DIRTY=1" >&2
+  exit 1
+fi
+
+head="$(git rev-parse HEAD)"
+if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+  tagged="$(git rev-list -n 1 "$tag")"
+  if [ "$tagged" != "$head" ]; then
+    echo "tag $tag points at $tagged, not HEAD $head" >&2
+    exit 1
+  fi
+else
+  git tag "$tag" "$head"
+fi
+
+if [ "$push_tag" = "1" ]; then
+  git push origin "$tag"
+fi
+
+if [ "$build" = "1" ]; then
+  sh scripts/package-release.sh
+fi
+
+scripts/upload-gitea-release.sh "$tag"
+
+api="$base/api/v1/repos/$repo"
+auth_header="Authorization: token $token"
+release_json="$(curl -fsS -H "$auth_header" "$api/releases/tags/$tag")"
+release_id=""
+if command -v jq >/dev/null 2>&1; then
+  release_id="$(printf '%s\n' "$release_json" | jq -r '.id // empty')"
+fi
+
+if [ "$prune" = "1" ] && [ -n "$release_id" ] && command -v jq >/dev/null 2>&1; then
+  printf '%s\n' "$release_json" \
+    | jq -r '.assets[]? | select(.name | test("^dosh-[0-9]")) | [.id, .name] | @tsv' \
+    | while IFS="$(printf '\t')" read -r asset_id name; do
+      [ -n "$asset_id" ] || continue
+      echo "deleting duplicate $name"
+      curl -fsS -H "$auth_header" -X DELETE "$api/releases/$release_id/assets/$asset_id" >/dev/null
+    done
+  release_json="$(curl -fsS -H "$auth_header" "$api/releases/tags/$tag")"
+fi
+
+web_repo="${base%/}/${repo}"
+failed=0
+for artifact in target/dosh-release/dosh-linux-*.tar.gz target/dosh-release/dosh-macos-*.tar.gz target/dosh-release/dosh-windows-*.zip; do
+  [ -f "$artifact" ] || continue
+  name="$(basename "$artifact")"
+  case "$name" in
+    dosh-[0-9]*)
+      continue
+      ;;
+  esac
+  url="$web_repo/releases/download/$tag/$name"
+  if curl -fsSI "$url" >/dev/null; then
+    echo "verified $url"
+  else
+    echo "missing release asset: $url" >&2
+    failed=1
+  fi
+done
+
+if [ "$failed" != "0" ]; then
+  exit 1
+fi
+
+if command -v jq >/dev/null 2>&1; then
+  printf '%s\n' "$release_json" | jq -r '"assets=\(.assets|length)", (.assets[] | "\(.name) \(.size)")'
+fi