diff --git a/package-lock.json b/package-lock.json
index d0adef7..9f26755 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "kestrove-desktop",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "kestrove-desktop",
-      "version": "0.1.0",
+      "version": "1.0.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@tauri-apps/api": "2.12.3"
diff --git a/package.json b/package.json
index c9a9e3a..7977ad2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "kestrove-desktop",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
diff --git a/scripts/gitea-release.sh b/scripts/gitea-release.sh
new file mode 100755
index 0000000..dcfb050
--- /dev/null
+++ b/scripts/gitea-release.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+# Creates (or reuses) the Gitea release for this version and uploads the desktop bundles to it.
+#
+#   GITEA_TOKEN=… scripts/gitea-release.sh [dir-with-files]      (default ../release/desktop)
+#
+# GITEA_TOKEN: a Gitea access token with the write:repository scope (Settings → Applications). The tag
+# v<version> must already be pushed. Files: *.AppImage, *.deb, *-setup.exe, kestrove-nmh-*, SHA256SUMS.
+set -eu
+cd "$(dirname "$0")/.."
+: "${GITEA_TOKEN:?set GITEA_TOKEN (Gitea → Settings → Applications → token with write:repository)}"
+API=${GITEA_API:-https://gitea.samialabri.com/api/v1}
+REPO=${GITEA_REPO:-kestrove/kestrove-desktop}
+DIR=${1:-../release/desktop}
+V=$(node -p 'require("./package.json").version')
+TAG="v$V"
+AUTH="Authorization: token $GITEA_TOKEN"
+
+(cd "$DIR" && rm -f SHA256SUMS && shasum -a 256 -- *.AppImage *.deb *-setup.exe kestrove-nmh-* 2>/dev/null > SHA256SUMS; cat SHA256SUMS)
+
+ID=$(curl -fsS -H "$AUTH" "$API/repos/$REPO/releases/tags/$TAG" 2>/dev/null | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{console.log(JSON.parse(s).id||"")}catch{console.log("")}})')
+if [ -z "$ID" ]; then
+  BODY=$(node -e 'console.log(JSON.stringify({tag_name: process.argv[1], name: "Kestrove " + process.argv[2], body: "Kestrove desktop " + process.argv[2] + " for Windows and Linux. On a Mac, use the Kestrove app from the Mac App Store instead.\n\nVerify downloads with SHA256SUMS.", draft: false, prerelease: false}))' "$TAG" "$V")
+  ID=$(curl -fsS -X POST -H "$AUTH" -H "Content-Type: application/json" -d "$BODY" "$API/repos/$REPO/releases" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>console.log(JSON.parse(s).id))')
+fi
+for f in "$DIR"/*.AppImage "$DIR"/*.deb "$DIR"/*-setup.exe "$DIR"/kestrove-nmh-* "$DIR"/SHA256SUMS; do
+  [ -f "$f" ] || continue
+  echo "uploading $(basename "$f")"
+  curl -fsS -X POST -H "$AUTH" -F "attachment=@$f" "$API/repos/$REPO/releases/$ID/assets?name=$(basename "$f")" >/dev/null
+done
+echo "Release: ${API%/api/v1}/$REPO/releases/tag/$TAG"
diff --git a/scripts/linux.Dockerfile b/scripts/linux.Dockerfile
new file mode 100644
index 0000000..5654925
--- /dev/null
+++ b/scripts/linux.Dockerfile
@@ -0,0 +1,22 @@
+# Linux release bundles (AppImage + .deb) for the Gitea release, built in a clean Debian 12 container:
+#   docker buildx build --platform linux/amd64 -f kestrove-desktop/scripts/linux.Dockerfile \
+#     --target out -o type=local,dest=release/desktop ..
+# Build context = the folder holding kestrove-core and kestrove-desktop. Debian 12's glibc (2.36) keeps
+# the AppImage runnable on most current distributions.
+FROM rust:1-bookworm AS build
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libssl-dev libxdo-dev \
+      libsecret-1-dev file patchelf xdg-utils curl ca-certificates \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && apt-get install -y nodejs \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+COPY kestrove-core kestrove-core
+COPY kestrove-desktop kestrove-desktop
+WORKDIR /src/kestrove-desktop
+RUN npm ci --no-audit --no-fund && npm run tauri build -- --bundles appimage,deb \
+    && cd src-tauri && cargo build --release --bin kestrove-nmh
+
+FROM scratch AS out
+COPY --from=build /src/kestrove-desktop/src-tauri/target/release/bundle/appimage/*.AppImage /
+COPY --from=build /src/kestrove-desktop/src-tauri/target/release/bundle/deb/*.deb /
+COPY --from=build /src/kestrove-desktop/src-tauri/target/release/kestrove-nmh /kestrove-nmh-linux-x86_64
diff --git a/scripts/linux.Dockerfile.dockerignore b/scripts/linux.Dockerfile.dockerignore
new file mode 100644
index 0000000..f39fcdf
--- /dev/null
+++ b/scripts/linux.Dockerfile.dockerignore
@@ -0,0 +1,5 @@
+**/target
+**/node_modules
+**/dist
+**/.git
+kestrove-core/fuzz
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index ad4272b..761c285 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -3012,7 +3012,7 @@ dependencies = [
 
 [[package]]
 name = "kestrove-desktop"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "arboard",
  "base64 0.22.1",
@@ -3086,7 +3086,7 @@ dependencies = [
 
 [[package]]
 name = "kv-crypto"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "argon2",
  "chacha20poly1305",
@@ -3104,7 +3104,7 @@ dependencies = [
 
 [[package]]
 name = "kv-ffi"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "aes-gcm",
  "base64 0.22.1",
@@ -3131,7 +3131,7 @@ dependencies = [
 
 [[package]]
 name = "kv-import"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "argon2",
  "chacha20poly1305",
@@ -3151,7 +3151,7 @@ dependencies = [
 
 [[package]]
 name = "kv-ipc"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "libc",
  "serde_json",
@@ -3160,7 +3160,7 @@ dependencies = [
 
 [[package]]
 name = "kv-model"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "data-encoding",
  "hmac 0.12.1",
@@ -3179,7 +3179,7 @@ dependencies = [
 
 [[package]]
 name = "kv-proto"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "base64 0.22.1",
  "opaque-ke",
@@ -3190,7 +3190,7 @@ dependencies = [
 
 [[package]]
 name = "kv-store"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "kv-proto",
  "rusqlite",
@@ -3201,7 +3201,7 @@ dependencies = [
 
 [[package]]
 name = "kv-sync"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "base64 0.22.1",
  "blake3",
@@ -5581,7 +5581,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 791afe4..692ac33 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "kestrove-desktop"
-version = "0.1.0"
+version = "1.0.0"
 edition = "2021"
 rust-version = "1.82"
 license = "Apache-2.0"
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 7ee6d8d..8fd236c 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Kestrove",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "identifier": "app.kestrove.desktop",
   "build": {
     "beforeDevCommand": "npm run dev",