diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml
new file mode 100644
index 0000000..1fe4331
--- /dev/null
+++ b/.woodpecker/release.yaml
@@ -0,0 +1,82 @@
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+steps:
+  - name: test
+    image: golang:1.23
+    commands:
+      - go test ./...
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: build
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    commands:
+      - make dist-build VERSION=${CI_COMMIT_TAG}
+    depends_on: [test]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: package
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
+    depends_on: [build]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: upload-rpm
+    image: git.unkin.net/unkin/almalinux9-base:20260606
+    commands:
+      - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-internal"
+        for rpm in dist/*.rpm; do
+          FILE=$$(basename "$$rpm")
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            continue
+          fi
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
+        done
+    depends_on: [package]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
diff --git a/Makefile b/Makefile
index af6af11..247f2b0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,12 +1,17 @@
-BINARY := tomswall
-MODULE := git.unkin.net/unkin/tomswall
-PREFIX := /usr/local
+BINARY  := tomswall
+MODULE  := git.unkin.net/unkin/tomswall
+PREFIX  := /usr/local
 CONFDIR := /etc/tomswall
+DIST    := dist
+VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
+OS      ?= $(shell go env GOOS)
+ARCH    ?= $(shell go env GOARCH)
 
-.PHONY: build install clean check test
+.PHONY: build install clean check test fmt dist-build completions rpm rpm-package patch minor major _tag
 
 build:
-	go build -o $(BINARY) ./cmd/tomswall
+	go build $(GOFLAGS) -o $(BINARY) ./cmd/tomswall
 
 install: build
 	install -Dm755 $(BINARY) $(DESTDIR)$(PREFIX)/sbin/$(BINARY)
@@ -17,9 +22,54 @@ install: build
 
 clean:
 	rm -f $(BINARY)
+	rm -rf $(DIST)
 
 check:
 	go vet ./...
 
 test:
 	go test ./...
+
+fmt:
+	gofmt -w .
+
+# Build the binary into dist/ for the RPM packaging step.
+dist-build:
+	@mkdir -p $(DIST)
+	CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build $(GOFLAGS) -o $(DIST)/$(BINARY) ./cmd/tomswall
+
+# Generate bash/zsh completions into dist/completions.
+completions: dist-build
+	@mkdir -p $(DIST)/completions
+	$(DIST)/$(BINARY) completion bash > $(DIST)/completions/$(BINARY).bash
+	$(DIST)/$(BINARY) completion zsh  > $(DIST)/completions/_$(BINARY)
+
+# Build the binary then package it (with completions) into an RPM via nfpm.
+rpm: dist-build rpm-package
+
+# Package an already-built dist/ binary into an RPM (used by CI after build).
+rpm-package:
+	./scripts/build-rpm.sh $(VERSION)
+
+# Bump helpers — read the latest semver tag and create+push the next one, which
+# triggers the release-on-tag pipeline. Starts from v0.0.0 when no tag exists.
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+_tag:
+	git push origin $(TAG)
diff --git a/packaging/nfpm.yaml b/packaging/nfpm.yaml
new file mode 100644
index 0000000..823bd11
--- /dev/null
+++ b/packaging/nfpm.yaml
@@ -0,0 +1,58 @@
+---
+# nfpm config for building the tomswall RPM.
+# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - tomswall
+provides:
+  - tomswall
+
+contents:
+  - src: dist/tomswall
+    dst: /usr/sbin/tomswall
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+
+  # Example configuration (never overwrites an existing tomswall.yaml).
+  - src: tomswall.example.yaml
+    dst: /etc/tomswall/tomswall.example.yaml
+    file_info:
+      mode: 0644
+
+  # systemd unit + environment file for the control-plane agent.
+  - src: packaging/tomswall-agent.service
+    dst: /usr/lib/systemd/system/tomswall-agent.service
+    file_info:
+      mode: 0644
+  - src: packaging/tomswall-agent.env
+    dst: /etc/tomswall/agent.env
+    type: config|noreplace
+    file_info:
+      mode: 0640
+
+  # Shell completions (generated by scripts/build-rpm.sh before packaging).
+  - src: dist/completions/tomswall.bash
+    dst: /usr/share/bash-completion/completions/tomswall
+    file_info:
+      mode: 0644
+  - src: dist/completions/_tomswall
+    dst: /usr/share/zsh/site-functions/_tomswall
+    file_info:
+      mode: 0644
diff --git a/packaging/tomswall-agent.env b/packaging/tomswall-agent.env
new file mode 100644
index 0000000..5f14bbf
--- /dev/null
+++ b/packaging/tomswall-agent.env
@@ -0,0 +1,12 @@
+# Environment for the tomswall control-plane agent (tomswall-agent.service).
+# The agent reads these; flags may also be passed via ExecStart.
+
+# Base URL of the tomswallapi control plane.
+TOMSWALL_API_URL=https://tomswallapi.k8s.syd1.au.unkin.net
+
+# Agent bearer token (issued by the control plane / Vault). Keep this file 0640.
+TOMSWALL_AGENT_TOKEN=
+
+# The device name defaults to the system hostname. To override it, add
+# `--device <name>` to ExecStart in the unit (drop-in), e.g.:
+#   ExecStart=/usr/sbin/tomswall agent --device fw-a
diff --git a/packaging/tomswall-agent.service b/packaging/tomswall-agent.service
new file mode 100644
index 0000000..8996b03
--- /dev/null
+++ b/packaging/tomswall-agent.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=tomswall control-plane agent (pull and apply firewall config)
+Documentation=https://git.unkin.net/unkin/tomswall
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/tomswall/agent.env
+ExecStart=/usr/sbin/tomswall agent
+Restart=on-failure
+RestartSec=10
+# The agent programs nftables and needs the requisite capabilities.
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+
+[Install]
+WantedBy=multi-user.target
diff --git a/scripts/build-rpm.sh b/scripts/build-rpm.sh
new file mode 100755
index 0000000..98a41a9
--- /dev/null
+++ b/scripts/build-rpm.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+#
+# Package the (already built) tomswall binary into an RPM with nfpm, bundling
+# generated bash/zsh shell completions and the systemd agent unit.
+# Usage: scripts/build-rpm.sh [version]   (version defaults to $CI_COMMIT_TAG)
+#
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT_DIR}"
+
+VERSION="${1:-${CI_COMMIT_TAG:-0.0.0-dev}}"
+VERSION="${VERSION#v}" # strip a leading v
+BINARY="tomswall"
+DIST="dist"
+
+if [ ! -f "${DIST}/${BINARY}" ]; then
+  echo "ERROR: ${DIST}/${BINARY} not found; run 'make dist-build' first" >&2
+  exit 1
+fi
+
+# Generate shell completions from the freshly built binary so they always match
+# the shipped flags/subcommands.
+COMP_DIR="${DIST}/completions"
+mkdir -p "${COMP_DIR}"
+"./${DIST}/${BINARY}" completion bash >"${COMP_DIR}/${BINARY}.bash"
+"./${DIST}/${BINARY}" completion zsh >"${COMP_DIR}/_${BINARY}"
+
+export PACKAGE_NAME="${BINARY}"
+export PACKAGE_VERSION="${VERSION}"
+export PACKAGE_RELEASE="1"
+export PACKAGE_ARCH="amd64"
+export PACKAGE_PLATFORM="linux"
+export PACKAGE_DESCRIPTION="Spiritual successor to shorewall — nftables firewall manager, with a control-plane agent that pulls compiled config from tomswallapi"
+export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
+export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/tomswall"
+export PACKAGE_LICENSE="MIT"
+
+envsubst <packaging/nfpm.yaml >"${DIST}/nfpm.yaml"
+nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
+
+echo "Built:"
+ls -1 "${DIST}"/*.rpm