diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..2ca68e4
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,114 @@
+name: Release
+
+# A `v*` tag builds the package on each architecture's own runner
+# (x86_64 on ergo's bare runner, aarch64 on klokka's) and uploads it
+# to the [uhhm] Arch registry, like uhhm/gdo and bl/djdeck. Hosts then
+# `pacman -S wldash`. The tag has to agree with PKGBUILD's pkgver and
+# Cargo.toml's version, and CHANGELOG.md has to have the section; a
+# release with the tag's notes is created from the x86_64 job.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  package:
+    strategy:
+      matrix:
+        include:
+          - arch: x86_64
+            runs-on: bare
+            # The bare runner's shared toolchain and caches, with the
+            # writable cargo home uhhm/iris and uhhm/gdo use.
+            cargo_home: /var/local/cargo-target/iris-cargo-home
+            rustc_wrapper: /usr/bin/sccache
+            rustup_home: /var/local/rustup
+            target_dir: /var/local/cargo-target
+          - arch: aarch64
+            runs-on: aarch64
+            # klokka's host runner: rustup's stable (step below), defaults everywhere.
+            cargo_home: ""
+            rustc_wrapper: ""
+            rustup_home: ""
+            target_dir: ""
+    runs-on: ${{ matrix.runs-on }}
+    env:
+      CARGO_HOME: ${{ matrix.cargo_home }}
+      RUSTC_WRAPPER: ${{ matrix.rustc_wrapper }}
+      RUSTUP_HOME: ${{ matrix.rustup_home }}
+      CARGO_TARGET_DIR: ${{ matrix.target_dir }}
+      PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
+      SCCACHE_DIR: /var/local/sccache
+      SCCACHE_SERVER_PORT: "4228"
+    steps:
+      # v4 built-in checkout: native Go, needs no Node (the aarch64 host runner
+      # has none) and keeps the token out of a fetch URL.
+      - name: Checkout
+        uses: builtin:checkout
+
+      # klokka's runner has rustup but no default toolchain, so its cargo
+      # proxy refuses to run without this.
+      - name: Install Rust stable (aarch64)
+        if: matrix.arch == 'aarch64'
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Check tag matches pkgver and Cargo.toml
+        run: |
+          want="${GITHUB_REF_NAME#v}"
+          have=$(sed -n 's/^pkgver=//p' PKGBUILD)
+          [ "$want" = "$have" ] || { echo "tag $GITHUB_REF_NAME != pkgver $have" >&2; exit 1; }
+          cargo_ver=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+          [ "$want" = "$cargo_ver" ] || { echo "tag $GITHUB_REF_NAME != Cargo.toml version $cargo_ver" >&2; exit 1; }
+          notes=$(awk -v v="$want" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
+          [ -n "$(printf "%s" "$notes" | tr -d "[:space:]")" ] || { echo "CHANGELOG.md has no section for $GITHUB_REF_NAME" >&2; exit 1; }
+
+      # Bare runners are never mutated by CI: wldash's system libraries
+      # (dbus, libpulse, libxkbcommon, fontconfig, wayland) must already be
+      # installed on the host. Fail loud if one is missing.
+      - name: Check system build deps
+        run: |
+          missing=""
+          for lib in dbus-1 libpulse xkbcommon fontconfig wayland-client; do
+            pkg-config --exists "$lib" || missing="$missing $lib"
+          done
+          [ -z "$missing" ] || { echo "::error::bare runner missing:$missing — install once on the host" >&2; exit 1; }
+
+      # -d: cargo is the shared toolchain, not a pacman package the
+      # runner could verify. Builds and tests from the checkout. Empty
+      # env values above are unset here so cargo's defaults apply.
+      - name: Build package
+        run: |
+          for v in CARGO_HOME RUSTC_WRAPPER RUSTUP_HOME CARGO_TARGET_DIR; do
+            eval "[ -n \"\$$v\" ]" || unset "$v"
+          done
+          makepkg -f -d --noconfirm
+
+      # REGISTRY_TOKEN is a write:package token for bl, a secret on this
+      # repo. The registry namespace is always bl: pacman.conf's [uhhm]
+      # points at /api/packages/bl/arch/uhhm. Without the secret the build
+      # still runs so the tag is verified; re-run the job once it is set.
+      - name: Publish to the Arch package registry
+        run: |
+          set -euo pipefail
+          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "::warning::REGISTRY_TOKEN not set — skipping Arch registry publish"
+            exit 0
+          fi
+          for pkg in $(makepkg --packagelist); do
+            echo "==> $pkg"
+            curl --fail-with-body --user "bl:${{ secrets.REGISTRY_TOKEN }}" \
+              --upload-file "$pkg" \
+              "${{ gitea.server_url }}/api/packages/bl/arch/uhhm"
+          done
+
+      - name: Release notes
+        if: matrix.arch == 'x86_64'
+        run: |
+          set -euo pipefail
+          tag="${{ github.ref_name }}"
+          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
+          auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
+          notes=$(awk -v v="${tag#v}" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
+          body=$(jq -n --arg tag "$tag" --arg notes "$notes" '{tag_name: $tag, name: $tag, body: $notes}')
+          curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' -d "$body" "$api/releases" > /dev/null \
+            || echo "release $tag exists"
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..3afbea3
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,16 @@
+# Changelog
+
+## 0.4.0 (2026-10-03)
+
+First release of the project.uhhm.no fork, packaged for the `[uhhm]` Arch registry. Numbering: upstream's old code base was tagged up to v0.3.0 and the rewrite called itself 0.2.0; this fork continues above both so pacman sees a monotonic version.
+
+- Launcher: the prompt cursor was a byte offset in some places and a grapheme index in others, so typing æøå and then End or another key crashed wldash. The cursor is grapheme-based everywhere, Up stops at the last row, mouse selection can't underflow, and all desktop Exec field codes (`%i`, `%c`, `%k`, `%%`, ...) are stripped.
+- No more aborting on machines without a backlight, battery or PulseAudio: `/sys/class/backlight` itself was taken for a device, UPower's always-present DisplayDevice for a battery, and a failed audio connection panicked a thread (fatal with `panic = "abort"`).
+- Redraws: `Geometry::expand` computed the damage height from the wrong field; buffer refcounts no longer underflow; `wl_shm_pool`s are destroyed on resize.
+- Input: a key-repeat rate of 0 divided by zero; Escape is now seen by the launcher first so the prompt is saved for Ctrl+R; the first layer-surface configure always lays out.
+- Config: `/etc/wldash/config.yml` takes precedence over `~/.config/wldash/config.yml` when present (machine-local layout on NFS-shared homes); `--config` overrides both. Errors print one line and exit 1 instead of panicking.
+- Housekeeping: `memmap` → `memmap2`, unused `shlex` dropped, zero rustc/clippy warnings, rustfmt applied, unit tests for the prompt, Exec parsing and geometry.
+
+## 0.2.0
+
+Upstream (kennylevinsen/wldash) rewrite, the state this fork started from.
diff --git a/Cargo.lock b/Cargo.lock
index 916ffff..fa6cc30 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1265,7 +1265,7 @@ checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
 
 [[package]]
 name = "wldash"
-version = "0.2.0"
+version = "0.4.0"
 dependencies = [
  "calloop",
  "chrono",
diff --git a/Cargo.toml b/Cargo.toml
index a07b1ed..4c0d486 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wldash"
-version = "0.2.0"
+version = "0.4.0"
 edition = "2024"
 
 [profile.release]
diff --git a/PKGBUILD b/PKGBUILD
new file mode 100644
index 0000000..b3e9dc3
--- /dev/null
+++ b/PKGBUILD
@@ -0,0 +1,40 @@
+# Maintainer: Bendik Aagaard Lynghaug <bendik.lynghaug@gmail.com>
+# Built from the tagged checkout by .gitea/workflows/release.yml, once
+# per architecture, and uploaded to the [uhhm] registry on
+# project.uhhm.no (namespace bl). pkgver is the version; the tag has
+# to agree with it and with Cargo.toml.
+pkgname=wldash
+pkgver=0.4.0
+pkgrel=1
+pkgdesc="Dashboard/launcher/control-panel for wlroots-style Wayland compositors (layer-shell)"
+arch=('x86_64' 'aarch64')
+url="https://project.uhhm.no/bl/wldash"
+license=('GPL-3.0-only')
+depends=('glibc' 'gcc-libs' 'dbus' 'libpulse' 'libxkbcommon' 'fontconfig' 'wayland')
+makedepends=('cargo')
+optdepends=('upower: battery widget'
+            'pipewire-pulse: volume widget (or pulseaudio)')
+# !lto: Cargo.toml already does lto = "fat"; makepkg's -flto in RUSTFLAGS
+# would only fight it. !debug: panic = "abort" release, nothing to strip.
+options=('!debug' '!lto')
+
+# Sources are the checkout itself: makepkg resolves local sources by
+# basename next to the PKGBUILD, so the tagged tree CI builds from is
+# the source of truth, as in uhhm/gdo.
+
+build() {
+    cd "$startdir"
+    cargo build --release --locked
+}
+
+check() {
+    cd "$startdir"
+    cargo test --release --locked
+}
+
+package() {
+    cd "$startdir"
+    install -Dm755 "${CARGO_TARGET_DIR:-target}/release/wldash" "$pkgdir/usr/bin/wldash"
+    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}