diff --git a/.gitea/workflows/arch-package.yml b/.gitea/workflows/arch-package.yml
new file mode 100644
index 0000000..59b2f9a
--- /dev/null
+++ b/.gitea/workflows/arch-package.yml
@@ -0,0 +1,59 @@
+name: Build & publish Arch package
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  arch-package:
+    # Adjust the label to one your act_runner registered with. The runner must
+    # use the Docker backend so the archlinux container below can start.
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:latest
+    env:
+      PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
+      SERVER_URL: ${{ github.server_url }}
+      REPO: ${{ github.repository }}
+      OWNER: ${{ github.repository_owner }}
+      SHA: ${{ github.sha }}
+      # Arch registry name (the "$repo" in clients' pacman.conf). Arbitrary label.
+      ARCH_REPO: stable
+    steps:
+      - name: Install build dependencies
+        run: |
+          pacman -Syu --noconfirm --needed \
+            base-devel git go nodejs pnpm curl sudo \
+            webkit2gtk-4.1 gtk3 alsa-lib
+
+      - name: Create unprivileged build user
+        run: |
+          useradd -m builder
+          install -d -o builder -g builder /build
+          echo 'builder ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/builder
+
+      - name: Clone repo at the pushed commit
+        run: |
+          # Token auth works for private repos and needs no SSH key in CI.
+          sudo -u builder git clone \
+            "https://x-access-token:${PACKAGE_TOKEN}@${SERVER_URL#https://}/${REPO}.git" \
+            /build/yellowjacket
+          sudo -u builder git -C /build/yellowjacket checkout --detach "$SHA"
+
+      - name: Build package with makepkg
+        run: |
+          cd /build/yellowjacket/packaging/arch
+          # Point the PKGBUILD at this local clone / exact commit; pkgver() then
+          # derives the version from git automatically.
+          sudo -u builder \
+            env YJ_GITURL="git+file:///build/yellowjacket" YJ_GITREF="#commit=${SHA}" \
+            makepkg -f --noconfirm --cleanbuild
+
+      - name: Publish to the Gitea Arch registry
+        run: |
+          cd /build/yellowjacket/packaging/arch
+          pkg=$(ls yellowjacket-*.pkg.tar.zst)
+          echo "Uploading $pkg"
+          curl --fail-with-body --user "${OWNER}:${PACKAGE_TOKEN}" \
+            --upload-file "$pkg" \
+            "${SERVER_URL}/api/packages/${OWNER}/arch/${ARCH_REPO}"
diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
new file mode 100644
index 0000000..38e0247
--- /dev/null
+++ b/packaging/arch/PKGBUILD
@@ -0,0 +1,67 @@
+# Maintainer: yonlu <yj@yellowjacket.app>
+pkgname=yellowjacket
+pkgver=1.3.0
+pkgrel=1
+pkgdesc="Cross-platform desktop music player — local library, MusicBrainz explore & auto-tag"
+arch=('x86_64')
+url="https://git.ljones.me/yonlu/yellowjacket"
+license=('custom')
+depends=('webkit2gtk-4.1' 'gtk3' 'alsa-lib' 'hicolor-icon-theme')
+makedepends=('go>=1.25' 'nodejs>=22' 'pnpm' 'git')
+options=('!lto')
+
+# Source is overridable so the same PKGBUILD works two ways:
+#   * Manual release build (default): clones the tag over SSH (port 2222).
+#       git push origin v$pkgver   # push the tag first
+#   * CI build on push to main: the workflow sets these to a local file:// clone
+#     at the exact pushed commit, e.g.
+#       YJ_GITURL="git+file:///build/yellowjacket" YJ_GITREF="#commit=$SHA"
+_giturl="${YJ_GITURL:-git+ssh://git@git.ljones.me:2222/yonlu/yellowjacket.git}"
+_gitref="${YJ_GITREF:-#tag=v$pkgver}"
+source=("$pkgname::${_giturl}${_gitref}"
+        "yellowjacket.desktop")
+sha256sums=('SKIP'
+            'SKIP')
+
+# Derive the real version from git: a clean tag gives 1.3.0.r0.gHASH, commits
+# past a tag give 1.3.0.r<N>.gHASH — monotonic and pacman-friendly, so every
+# push to main is a newer version than the last.
+pkgver() {
+  cd "$srcdir/$pkgname"
+  git describe --long --tags --abbrev=7 2>/dev/null \
+    | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' \
+    || printf '0.0.0.r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+}
+
+prepare() {
+  cd "$srcdir/$pkgname"
+  export GOPATH="$srcdir/gopath" GOFLAGS="-mod=mod -modcacherw"
+  go mod download
+}
+
+build() {
+  cd "$srcdir/$pkgname"
+  export GOPATH="$srcdir/gopath" GOFLAGS="-mod=mod -modcacherw" CGO_ENABLED=1
+
+  local commit
+  commit="$(git rev-parse --short HEAD)"
+
+  # `go tool wails/sqlc/templ` resolve from the tool directives in go.mod, so no
+  # extra CLIs are needed. Wails runs the frontend install+build itself.
+  go generate ./...
+  go tool wails build -tags webkit2_41 -clean -trimpath \
+    -ldflags "-s -w -X 'main.version=v$pkgver' -X 'main.commit=$commit'"
+}
+
+package() {
+  cd "$srcdir/$pkgname"
+
+  install -Dm755 build/bin/yellowjacket "$pkgdir/usr/bin/yellowjacket"
+  install -Dm644 "$srcdir/yellowjacket.desktop" \
+    "$pkgdir/usr/share/applications/yellowjacket.desktop"
+
+  # No real logo ships in the repo yet; reuse an in-app SVG as the menu icon.
+  # Swap this for a proper branded icon when one exists.
+  install -Dm644 frontend/src/assets/images/icons/music/compact-disc.svg \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/yellowjacket.svg"
+}
diff --git a/packaging/arch/yellowjacket.desktop b/packaging/arch/yellowjacket.desktop
new file mode 100644
index 0000000..f8222ea
--- /dev/null
+++ b/packaging/arch/yellowjacket.desktop
@@ -0,0 +1,12 @@
+[Desktop Entry]
+Type=Application
+Name=YellowJacket
+GenericName=Music Player
+Comment=Music how it was meant to bee
+Exec=yellowjacket
+Icon=yellowjacket
+Terminal=false
+Categories=AudioVideo;Audio;Player;GTK;
+MimeType=audio/mpeg;audio/flac;audio/ogg;audio/x-wav;
+StartupWMClass=yellowjacket
+Keywords=music;player;audio;library;