diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..db33257
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,10 @@
+# Kept out of the release archive: it ships to a package path, not a checkout.
+.editorconfig export-ignore
+.gitattributes export-ignore
+.gitignore export-ignore
+.luacheckrc export-ignore
+.pre-commit-config.yaml export-ignore
+.stylua.toml export-ignore
+.woodpecker export-ignore
+Makefile export-ignore
+tests export-ignore
diff --git a/.gitignore b/.gitignore
index 926ccaa..3fd8493 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 doc/tags
+dist/
diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml
new file mode 100644
index 0000000..c48c893
--- /dev/null
+++ b/.woodpecker/release.yaml
@@ -0,0 +1,75 @@
+when:
+  - event: tag
+
+steps:
+  - name: test
+    image: alpine:3.22
+    commands:
+      - apk add --no-cache neovim curl unzip tar zip make
+      - make test
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  # A source zip wrapping everything in a single "arti-pack-<version>"
+  # directory, the shape arti-pack's installer expects from a tag archive.
+  - name: package
+    image: alpine:3.22
+    commands:
+      - apk add --no-cache git make unzip
+      - make package VERSION=${CI_COMMIT_TAG}
+      - make verify-package VERSION=${CI_COMMIT_TAG}
+    depends_on: [test]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+
+  # Publish under the tag-archive path shape so arti-pack installs itself with
+  # registry ".../api/v2/remotes/nvim-plugins/files" and { 'unkin/arti-pack' }.
+  - name: publish
+    image: alpine:3.22
+    commands:
+      - apk add --no-cache curl
+      - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="nvim-plugins"
+        PATH_IN_REPO="unkin/arti-pack/archive/refs/tags/${CI_COMMIT_TAG}.zip"
+        ZIP=$$(ls dist/arti-pack-*.zip | head -1)
+        # Uploads are immutable (409 on overwrite); a re-run of an existing tag
+        # must not fail the pipeline. artifactapi has no HEAD route, so probe
+        # with GET.
+        code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/$$PATH_IN_REPO" || true)
+        if [ "$$code" = "200" ]; then
+          echo "$$PATH_IN_REPO already published (HTTP $$code); skipping upload"
+          exit 0
+        fi
+        echo "Uploading $$ZIP to $$REPO/$$PATH_IN_REPO (existence probe returned $$code)"
+        curl -f -X PUT \
+          "$$HOST/api/v2/remotes/$$REPO/files/$$PATH_IN_REPO" \
+          -H "Content-Type: application/zip" \
+          --data-binary @"$$ZIP"
+    depends_on: [package]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
diff --git a/Makefile b/Makefile
index c3d44e3..fafd95e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,10 @@
-.PHONY: test lint fmt pre-commit patch minor major _tag
+.PHONY: test lint fmt pre-commit package verify-package patch minor major _tag
+
+VERSION ?= $(shell git describe --tags --always)
+# Archive names drop the leading "v", the way tag source archives do.
+BARE_VERSION = $(patsubst v%,%,$(VERSION))
+DIST = dist
+ARCHIVE = $(DIST)/arti-pack-$(BARE_VERSION).zip
 
 test:
 	nvim --headless -l tests/run.lua
@@ -12,6 +18,41 @@ fmt:
 pre-commit:
 	@uvx pre-commit run --all-files
 
+# The prefix directory is what arti-pack's own extractor strips on install.
+package:
+	@mkdir -p $(DIST)
+	git archive --format=zip --prefix=arti-pack-$(BARE_VERSION)/ -o $(ARCHIVE) HEAD
+	@echo $(ARCHIVE)
+
+# Published uploads are immutable, so a malformed archive cannot be replaced at
+# its version path. Assert the shape before anything ships.
+RUNTIME_PATHS  = lua/ plugin/ doc/ README.md
+EXCLUDED_PATHS = tests/ .woodpecker/ Makefile .editorconfig .gitattributes \
+                 .gitignore .luacheckrc .pre-commit-config.yaml .stylua.toml
+
+verify-package:
+	@test -f $(ARCHIVE) || { echo "verify-package: $(ARCHIVE) not built"; exit 1; }
+	@names=$$(unzip -Z1 $(ARCHIVE)); \
+	roots=$$(printf '%s\n' "$$names" | cut -d/ -f1 | sort -u); \
+	if [ "$$(printf '%s\n' "$$roots" | wc -l)" -ne 1 ]; then \
+	  echo "verify-package: expected one top-level directory, found:"; \
+	  printf '  %s\n' $$roots; exit 1; \
+	fi; \
+	fail=0; \
+	printf '%s\n' "$$names" | grep -q "^$$roots/." || \
+	  { echo "verify-package: top-level $$roots is not a directory"; fail=1; }; \
+	for p in $(RUNTIME_PATHS); do \
+	  printf '%s\n' "$$names" | grep -q "^$$roots/$$p" || \
+	    { echo "verify-package: missing runtime path $$p"; fail=1; }; \
+	done; \
+	for p in $(EXCLUDED_PATHS); do \
+	  if printf '%s\n' "$$names" | grep -q "^$$roots/$$p"; then \
+	    echo "verify-package: excluded path $$p leaked into the archive"; fail=1; \
+	  fi; \
+	done; \
+	[ $$fail -eq 0 ] || exit 1; \
+	echo "verify-package: $(ARCHIVE) ok, root $$roots"
+
 # Bump helpers — read the latest semver tag and create the next one.
 # If no tag exists yet, start from v0.0.0.
 _LATEST = $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
diff --git a/README.md b/README.md
index 4b49e9d..ac1a191 100644
--- a/README.md
+++ b/README.md
@@ -18,13 +18,29 @@ from.
 
 ## Install
 
-arti-pack manages itself least awkwardly as a plain clone into the package path:
+Each tag is published as a source zip under the same tag-archive path shape
+arti-pack expects, so it installs the same way as everything it manages —
+mirror it into your own artifact repository and fetch it from there:
 
 ```sh
-git clone https://git.unkin.net/unkin/arti-pack \
+curl -fsSL -o /tmp/arti-pack.zip \
+  https://artifacts.example.com/artifactory/nvim-plugins/unkin/arti-pack/archive/refs/tags/v0.1.0.zip
+mkdir -p "${XDG_DATA_HOME:-$HOME/.local/share}/nvim/site/pack/arti-pack/start"
+unzip -q /tmp/arti-pack.zip -d /tmp/arti-pack
+mv /tmp/arti-pack/arti-pack-0.1.0 \
   "${XDG_DATA_HOME:-$HOME/.local/share}/nvim/site/pack/arti-pack/start/arti-pack"
 ```
 
+Once installed it can carry itself, since `url` bypasses the registry:
+
+```lua
+{
+  'unkin/arti-pack',
+  tag = 'v0.1.0',
+  url = 'https://artifacts.example.com/artifactory/nvim-plugins/unkin/arti-pack/archive/refs/tags/v0.1.0.zip',
+}
+```
+
 ## Usage
 
 ```lua