diff --git a/.gitignore b/.gitignore
index b37e36601..944b37ae7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
+/dist
+
 ### OSX ###
 .DS_Store
 .AppleDouble
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3e57168a4..0bbe20280 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -509,3 +509,28 @@ docker:
     name: docker_metadata_${CI_COMMIT_REF_NAME}
     paths:
       - metadata.json
+
+release:
+  stage: publish
+  needs:
+    - job: build_metadata
+      artifacts: true
+    - job: build_api
+      artifacts: true
+    - job: build_front
+      artifacts: true
+
+  image: $CI_REGISTRY/funkwhale/ci/python:3.11
+  variables:
+    <<: *keep_git_files_permissions
+  before_script:
+    - apt-get update
+    - apt-get install -y zip
+    - >
+      curl "https://gitlab.com/api/v4/projects/gitlab-org%2Frelease-cli/packages/generic/release-cli/latest/release-cli-linux-amd64"
+      --output /usr/local/bin/release-cli
+    - chmod +x /usr/local/bin/release-cli
+    - release-cli -v
+  script:
+    - make build
+    - scripts/ci-release.sh
diff --git a/Makefile b/Makefile
index e1f64e782..fcc1d995b 100644
--- a/Makefile
+++ b/Makefile
@@ -17,3 +17,39 @@ docker-build: docker-metadata
 
 build-metadata:
 	./scripts/build_metadata.py --format env | tee build_metadata.env
+
+VERSION ?= $(shell git describe --tags --abbrev=0)
+BUILD_DIR = dist
+build:
+	rm -Rf $(BUILD_DIR)
+	mkdir -p $(BUILD_DIR)
+	tar --create --gunzip --file='$(BUILD_DIR)/funkwhale-api-$(VERSION).tar.gz' \
+		--owner='root' \
+		--group='root' \
+		--exclude-vcs \
+		api/config \
+		api/funkwhale_api \
+		api/install_os_dependencies.sh \
+		api/manage.py \
+		api/poetry.lock \
+		api/pyproject.toml \
+		api/Readme.md
+
+	cd '$(BUILD_DIR)' && \
+	tar --extract --gunzip --file='funkwhale-api-$(VERSION).tar.gz' && \
+	zip -q 'funkwhale-api-$(VERSION).zip' -r api && \
+	rm -Rf api
+
+	tar --create --gunzip --file='$(BUILD_DIR)/funkwhale-front-$(VERSION).tar.gz' \
+		--owner='root' \
+		--group='root' \
+		--exclude-vcs \
+		--transform='s/^front\/dist/front/' \
+		front/dist
+
+	cd '$(BUILD_DIR)' && \
+	tar --extract --gunzip --file='funkwhale-front-$(VERSION).tar.gz' && \
+	zip -q 'funkwhale-front-$(VERSION).zip' -r front && \
+	rm -Rf front
+
+	cd '$(BUILD_DIR)' && sha256sum * > SHA256SUMS
diff --git a/changes/changelog.d/publish-release-in-ci.enhancement b/changes/changelog.d/publish-release-in-ci.enhancement
new file mode 100644
index 000000000..013665e89
--- /dev/null
+++ b/changes/changelog.d/publish-release-in-ci.enhancement
@@ -0,0 +1 @@
+Publish releases from CI job
diff --git a/scripts/ci-release.sh b/scripts/ci-release.sh
new file mode 100755
index 000000000..ab1a20025
--- /dev/null
+++ b/scripts/ci-release.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+
+# Make sure that https://docs.gitlab.com/ee/user/packages/generic_packages/#do-not-allow-duplicate-generic-packages
+# is enabled
+
+set -eu
+
+error() {
+  echo >&2 "error: $*"
+  exit 1
+}
+
+command -v curl > /dev/null || error "curl command not found!"
+
+CI_API_V4_URL="https://dev.funkwhale.audio/api/v4"
+CI_PROJECT_ID="955"
+CI_COMMIT_REF_NAME="1.3.0-rc4"
+CI_JOB_TOKEN="glpat-GyMCY55RP2D_pGjqnkKe"
+
+PACKAGE_REGISTRY_URL="$CI_API_V4_URL/projects/$CI_PROJECT_ID/packages/generic"
+PACKAGE_NAME="funkwhale"
+PACKAGE_VERSION="$CI_COMMIT_REF_NAME"
+
+join_by() {
+  local IFS="$1"
+  shift
+  echo "$*"
+}
+
+# publish_asset <asset> <file>
+publish_asset() {
+  echo "publishing release asset $asset"
+  curl \
+    --fail \
+    --show-error \
+    --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" \
+    --upload-file "$2" \
+    "$PACKAGE_REGISTRY_URL/$PACKAGE_NAME/$PACKAGE_VERSION/$1"
+  echo
+}
+
+# release_asset_json <asset>
+release_asset_json() {
+  printf '{"name": "%s", "url": "%s", "link_type": "package"}' \
+    "$1" \
+    "$PACKAGE_REGISTRY_URL/$PACKAGE_NAME/$PACKAGE_VERSION/$1"
+}
+
+# release_json <release_assets_json>
+release_json() {
+  printf '{"name": "%s", "tag_name": "%s", "assets": { "links": [%s]}}' "$PACKAGE_VERSION" "$PACKAGE_VERSION" "$1"
+}
+
+# publish_release <release_json>
+publish_release() {
+  echo "publishing release $PACKAGE_VERSION"
+  curl \
+    --fail \
+    --show-error \
+    --request POST \
+    --header "Content-Type: application/json" \
+    --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" \
+    --data "$1" \
+    "$CI_API_V4_URL/projects/$CI_PROJECT_ID/releases"
+  echo
+}
+
+release_assets=()
+for asset_path in dist/*; do
+  asset="$(basename "$asset_path")"
+  publish_asset "$asset" "$asset_path"
+  release_assets+=("$(release_asset_json "$asset")")
+done
+
+publish_release "$(release_json "$(join_by , "${release_assets[@]}")")"