diff --git a/.woodpecker/gitea-release.yml b/.woodpecker/gitea-release.yml
new file mode 100644
index 0000000..4371e2d
--- /dev/null
+++ b/.woodpecker/gitea-release.yml
@@ -0,0 +1,28 @@
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+depends_on:
+  - verify
+  - linux-release
+  - windows-release
+
+steps:
+  - name: publish-gitea-release
+    image: bash
+    environment:
+      GITEA_BASE: http://192.168.2.162:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - bash ci/publish-gitea-release.sh
diff --git a/ci/publish-gitea-release.sh b/ci/publish-gitea-release.sh
new file mode 100644
index 0000000..97f0a02
--- /dev/null
+++ b/ci/publish-gitea-release.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Create/update the Gitea Release after all platform package workflows succeed.
+set -euo pipefail
+
+tag="${CI_COMMIT_TAG:-}"
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
+
+version="${tag#v}"
+gitea_base="${GITEA_BASE:-http://192.168.2.162:3100}"
+gitea_base="${gitea_base%/}"
+gitea_host="${gitea_base#https://}"
+gitea_host="${gitea_host#http://}"
+gitea_host="${gitea_host%%/*}"
+gitea_host="${gitea_host%%:*}"
+api="$gitea_base/api/v1/repos/justme/MyMonitor"
+tmp="$(mktemp -d)"
+netrc="$tmp/netrc"
+release_json="$tmp/release.json"
+assets_json="$tmp/assets.json"
+chmod 700 "$tmp"
+printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
+chmod 600 "$netrc"
+trap 'rm -rf "$tmp"' EXIT
+
+release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+  --output "$release_json" --write-out '%{http_code}' "$api/releases/tags/$tag")"
+if [[ "$release_status" == 404 ]]; then
+  payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MyMonitor %s","body":"Agent and Probe archives for Linux and Windows amd64 and arm64. Backend OCI images: registry.oeo.one/monitor/monitor-backend:%s (linux/amd64 and linux/arm64).","draft":false,"prerelease":false}' \
+    "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$version")"
+  release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+    --header 'Content-Type: application/json' --data "$payload" \
+    --output "$release_json" --write-out '%{http_code}' "$api/releases")"
+fi
+[[ "$release_status" =~ ^2 ]] || {
+  echo "Gitea Release lookup/create failed (HTTP $release_status)" >&2
+  cat "$release_json" >&2
+  exit 1
+}
+release_id="$(grep -o '"id":[[:space:]]*[0-9][0-9]*' "$release_json" | head -1 | tr -cd '0-9')"
+[[ -n "$release_id" ]] || { echo "Could not read Gitea Release ID" >&2; exit 1; }
+curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+  "$api/releases/$release_id/assets" -o "$assets_json"
+
+assets=(
+  "monitor-agent-v$version-linux-amd64.tar.gz"
+  "monitor-agent-v$version-linux-arm64.tar.gz"
+  "monitor-probe-v$version-linux-amd64.tar.gz"
+  "monitor-probe-v$version-linux-arm64.tar.gz"
+  "monitor-agent-v$version-windows-amd64.zip"
+  "monitor-agent-v$version-windows-arm64.zip"
+  "monitor-probe-v$version-windows-amd64.zip"
+  "monitor-probe-v$version-windows-arm64.zip"
+)
+for archive in "${assets[@]}"; do
+  for name in "$archive" "$archive.sha256"; do
+    if grep -Eq "\"name\"[[:space:]]*:[[:space:]]*\"$name\"" "$assets_json"; then
+      echo "release asset $name already exists; keeping the existing asset"
+      continue
+    fi
+    file="$tmp/$name"
+    curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+      "$gitea_base/api/packages/justme/generic/monitor-node/$version/$name" -o "$file"
+    status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+      --header 'Content-Type: application/octet-stream' --upload-file "$file" \
+      --output /dev/null --write-out '%{http_code}' \
+      "$api/releases/$release_id/assets?name=$name")"
+    case "$status" in
+      2*) echo "attached $name" ;;
+      *) echo "Gitea Release asset upload failed for $name (HTTP $status)" >&2; exit 1 ;;
+    esac
+  done
+done
+
+echo "published Gitea Release $tag: https://git.oeo.one/justme/MyMonitor/releases/tag/$tag"
diff --git a/docs/deployment.md b/docs/deployment.md
index 7749245..be9c0b3 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -36,7 +36,7 @@ Compose 将容器端口只绑定到宿主机 `127.0.0.1:8080`，适合由同机
 
 ## 节点二进制发布
 
-Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上构建 Agent 和 Probe 的 Windows/Linux amd64/arm64 NativeAOT 程序，打包为 `.zip` 或 `.tar.gz` 并上传到 Gitea Generic Packages。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 包带有安装脚本和 systemd/OpenWrt 单元；Windows 包包含可执行文件及对应 README。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
+Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上构建 Agent 和 Probe 的 Windows/Linux amd64/arm64 NativeAOT 程序，打包为 `.zip` 或 `.tar.gz` 并上传到 Gitea Generic Packages。所有平台构建和 Backend OCI 镜像发布成功后，CI 会创建对应的 Gitea Release，并将四个平台的 Agent/Probe 压缩包及 SHA-256 校验文件作为附件。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 包带有安装脚本和 systemd/OpenWrt 单元；Windows 包包含可执行文件及对应 README。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
 
 实测体积（`StackTraceSupport=false`、`IlcFoldIdenticalMethodBodies=true`、`OptimizationPreference=Size`）：