diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..cee8d4a
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  firmware:
+    runs-on: self-hosted
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install PlatformIO
+        run: pip install platformio
+
+      - name: Build firmware
+        run: pio run
+
+      - name: Copy firmware to Android assets
+        run: bash tools/copy_firmware.sh
+
+      - name: Upload firmware artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firmware
+          path: |
+            .pio/build/m5stack-atoms3r/firmware.bin
+            .pio/build/m5stack-atoms3r/bootloader.bin
+            .pio/build/m5stack-atoms3r/partitions.bin
+            android/app/src/main/assets/firmware/boot_app0.bin
+
+  android:
+    needs: firmware
+    runs-on: self-hosted
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download firmware
+        uses: actions/download-artifact@v4
+        with:
+          name: firmware
+
+      - name: Build debug APK
+        working-directory: android
+        run: ./gradlew assembleDebug
+        env:
+          ANDROID_HOME: ${{ vars.ANDROID_HOME || '/opt/android-sdk' }}
+
+      - name: Upload debug APK
+        uses: actions/upload-artifact@v4
+        with:
+          name: app-debug
+          path: android/app/build/outputs/apk/debug/app-debug.apk
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
new file mode 100644
index 0000000..bdb4d82
--- /dev/null
+++ b/.forgejo/workflows/release.yml
@@ -0,0 +1,64 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: self-hosted
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install PlatformIO
+        run: pip install platformio
+
+      - name: Build firmware
+        run: pio run
+
+      - name: Copy firmware to Android assets
+        run: bash tools/copy_firmware.sh
+
+      - name: Decode keystore
+        run: echo "${{ secrets.KEYSTORE_B64 }}" | base64 -d > android/keystore/sylda.jks
+        if: env.KEYSTORE_B64 != ''
+
+      - name: Write signing.properties
+        run: |
+          cat > android/signing.properties << 'PROPS'
+          storeFile=keystore/sylda.jks
+          storePassword=${{ secrets.KEYSTORE_PASS }}
+          keyAlias=${{ secrets.KEY_ALIAS }}
+          keyPassword=${{ secrets.KEY_PASS }}
+          PROPS
+
+      - name: Build release APK + AAB
+        working-directory: android
+        run: ./gradlew assembleRelease bundleRelease
+        env:
+          ANDROID_HOME: ${{ vars.ANDROID_HOME || '/opt/android-sdk' }}
+
+      - name: Gather release artifacts
+        run: |
+          mkdir -p release/artifacts
+          cp android/app/build/outputs/apk/release/app-release.apk release/artifacts/
+          cp android/app/build/outputs/bundle/release/app-release.aab release/artifacts/
+          cp android/app/src/main/assets/firmware/*.bin release/artifacts/
+          cd release/artifacts
+          sha256sum * > checksums.txt
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: release
+          path: release/artifacts/*
+
+      - name: Create Forgejo release
+        uses: https://git.eddydevink.nl/api/packages/eddy/actions/forgejo-release@v1
+        with:
+          token: ${{ secrets.FORGEJO_TOKEN }}
+          tag: ${{ github.ref_name }}
+          title: ${{ github.ref_name }}
+          files: release/artifacts/*