diff --git a/tools/publish_release.sh b/tools/publish_release.sh
new file mode 100755
index 0000000..acf9e9c
--- /dev/null
+++ b/tools/publish_release.sh
@@ -0,0 +1,42 @@
+#!/bin/sh
+# Publishes the release in build/ (tools/export.sh) on the Gitea repo:
+# creates release v<version> on its tag (push the tag first), uploads the two
+# zips and version.json, then checks each download matches its checksum.
+#
+#   read -s GITEA_TOKEN && export GITEA_TOKEN
+#   tools/publish_release.sh
+#
+# The token needs write access to the repository (Gitea: Settings >
+# Applications). It's read from the environment, never from the command line.
+
+cd "$(dirname "$0")/.." || exit 1
+API=${API:-https://git.psbailey.uk/api/v1/repos/Admin/Emberwild}
+[ -n "$GITEA_TOKEN" ] || { echo "set GITEA_TOKEN first: read -s GITEA_TOKEN && export GITEA_TOKEN"; exit 1; }
+[ -f build/version.json ] || { echo "no build/version.json: run tools/export.sh first"; exit 1; }
+VERSION=$(python3 -c "import json; print(json.load(open('build/version.json'))['version'])")
+NOTES=$(python3 -c "import json; print(json.load(open('build/version.json')).get('notes', ''))")
+TAG="v$VERSION"
+AUTH="Authorization: token $GITEA_TOKEN"
+
+git ls-remote --exit-code origin "refs/tags/$TAG" >/dev/null || { echo "push the tag first: git push origin $TAG"; exit 1; }
+
+BODY=$(python3 -c "import json,sys; print(json.dumps({'tag_name': sys.argv[1], 'name': 'Emberwild ' + sys.argv[2], 'body': sys.argv[3], 'draft': False, 'prerelease': False}))" "$TAG" "$VERSION" "$NOTES")
+ID=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -d "$BODY" "$API/releases" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('id') or ''); sys.stderr.write(d.get('message','') + '\n') if not d.get('id') else None")
+[ -n "$ID" ] || { echo "couldn't create the release (above)"; exit 1; }
+echo "release $TAG created (id $ID)"
+
+for f in version.json "Emberwild-$VERSION-macos.zip" "Emberwild-$VERSION-windows.zip"; do
+	[ -f "build/$f" ] || { echo "missing build/$f"; exit 1; }
+	R=$(curl -s -H "$AUTH" -F "attachment=@build/$f" "$API/releases/$ID/assets?name=$f")
+	echo "$R" | grep -q '"browser_download_url"' && echo "  uploaded $f" || { echo "  upload of $f failed: $R"; exit 1; }
+done
+
+# Check what anyone downloads is what was built.
+REPO=${API%/api/v1/repos/*}/$(echo "$API" | sed 's#.*/repos/##')
+for p in macos windows; do
+	f="Emberwild-$VERSION-$p.zip"
+	want=$(python3 -c "import json,sys; print(json.load(open('build/version.json'))['downloads'][sys.argv[1]]['sha256'])" $p)
+	got=$(curl -s -L "$REPO/releases/download/$TAG/$f" | shasum -a 256 | cut -d' ' -f1)
+	[ "$want" = "$got" ] && echo "  $f: checksum ok" || { echo "  $f: CHECKSUM MISMATCH"; exit 1; }
+done
+echo "done: $REPO/releases/tag/$TAG"