diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 36ca1af..03d5ae8 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -7,35 +7,21 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  nix-flake:
+    name: Nix flake checks
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
 
-      - uses: cachix/install-nix-action@v27
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
+      - name: Check flake
+        run: nix flake check --print-build-logs
 
-      # Builds the cdylib and runs the cargo tests (doCheck).
+      # package.sh bundles the cdylib from ./result/lib, so link the aac package first.
       - name: Build Rust core
         run: nix build .#aac --print-build-logs
 
-      # Rehearses the VPM release: stages the C# package, bundles libaac, updates vpm/index.json.
       - name: Package VPM zip
         run: nix develop -c ./vpm/package.sh
 
-      # The Unity bundle produced by the flake itself.
       - name: Build Unity bundle
         run: nix build .#default --print-build-logs
-
-      - name: Collect artifacts
-        run: |
-          mkdir -p dist
-          cp -L result dist/animator-as-crab-bundle.zip
-          cp vpm/dist/*.zip dist/
-
-      - uses: actions/upload-artifact@v3
-        with:
-          name: animator-as-crab
-          path: dist/*.zip
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index ba41a3f..49e768b 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -7,21 +7,14 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
+    name: Publish VPM release
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: cachix/install-nix-action@v27
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-
-      # package.sh globs $root/result/lib/*, so the aac package must be linked as ./result.
-      - name: Build native library
+      - name: Build Rust core
         run: nix build .#aac --print-build-logs
 
       - name: Package VPM zip
@@ -33,35 +26,20 @@ jobs:
           SERVER: ${{ github.server_url }}
           REPO: ${{ github.repository }}
           TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          manifest=csharp/dev.doloro.animator-as-crab/package.json
-          id=$(jq -r .name "$manifest")
-          version=$(jq -r .version "$manifest")
-          zip="vpm/dist/$id-$version.zip"
+        run: nix develop -c ./vpm/publish.sh
 
-          release=$(curl -fsS -X POST \
-            -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-            "$SERVER/api/v1/repos/$REPO/releases" \
-            -d "$(jq -n --arg tag "$TAG" --arg name "$id $version" \
-                   '{tag_name: $tag, name: $name, draft: false}')")
-
-          curl -fsS -X POST \
-            -H "Authorization: token $TOKEN" \
-            "$SERVER/api/v1/repos/$REPO/releases/$(jq -r .id <<<"$release")/assets?name=$(basename "$zip")" \
-            -F "attachment=@$zip"
-
-      # The index ships the zip's sha256, which only exists after packaging, so it is committed here.
+      # The index carries the zip's sha256, which only exists after packaging.
       - name: Commit updated VPM index
         env:
           TOKEN: ${{ secrets.VPM_TOKEN || secrets.GITHUB_TOKEN }}
+          SERVER: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          git config user.name  gitea-actions
+          git config user.name gitea-actions
           git config user.email actions@git.scug.io
           git add vpm/index.json
           git diff --cached --quiet && exit 0
-          version=$(jq -r .version csharp/dev.doloro.animator-as-crab/package.json)
-          git commit -m "vpm: index for $version"
-          git push "https://x-access-token:$TOKEN@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
-            HEAD:main
+          git commit -m "vpm: index for $TAG"
+          git push "https://x-access-token:$TOKEN@${SERVER#https://}/${REPO}.git" HEAD:main
diff --git a/flake.nix b/flake.nix
index a00f8c2..6a3f0de 100644
--- a/flake.nix
+++ b/flake.nix
@@ -93,6 +93,7 @@
             inputsFrom = [ aac ];
             packages = [
               rustToolchain
+              pkgs.curl
               pkgs.jq
               pkgs.zip
             ];
diff --git a/vpm/publish.sh b/vpm/publish.sh
new file mode 100755
index 0000000..d40f30f
--- /dev/null
+++ b/vpm/publish.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Creates the Gitea release for the current tag and attaches the VPM zip built by package.sh.
+#
+# Needs `curl` and `jq`: run it inside `nix develop`.
+#
+# Environment:
+#   TOKEN   required, Gitea token with repository write access
+#   SERVER  required, e.g. https://git.scug.io
+#   REPO    required, e.g. doloro/av3-animation-as-crab
+#   TAG     required, release tag
+set -euo pipefail
+
+root=$(cd "$(dirname "$0")/.." && pwd)
+manifest="$root/csharp/dev.doloro.animator-as-crab/package.json"
+
+id=$(jq -r .name "$manifest")
+version=$(jq -r .version "$manifest")
+zip="$root/vpm/dist/$id-$version.zip"
+
+zip_name=$(basename "$zip")
+[ -f "$zip" ] || { echo "missing $zip; run package.sh first" >&2; exit 1; }
+
+release=$(curl -fsS -X POST \
+  -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+  "$SERVER/api/v1/repos/$REPO/releases" \
+  -d "$(jq -n --arg tag "$TAG" --arg name "$id $version" '{tag_name: $tag, name: $name}')")
+
+asset_url="$SERVER/api/v1/repos/$REPO/releases/$(jq -r .id <<<"$release")/assets?name=$zip_name"
+
+curl -fsS -X POST \
+  -H "Authorization: token $TOKEN" \
+  "$asset_url" \
+  -F "attachment=@$zip"
+
+echo "released $TAG with $zip_name"