diff --git a/.gitea/workflows/build-tdlib.yaml b/.gitea/workflows/build-tdlib.yaml
new file mode 100644
index 0000000..cfac45f
--- /dev/null
+++ b/.gitea/workflows/build-tdlib.yaml
@@ -0,0 +1,180 @@
+name: Build TDLib
+
+on:
+  workflow_dispatch:
+    inputs:
+      tdlib_ref:
+        description: Optional TDLib tag or commit to build
+        required: false
+        type: string
+  schedule:
+    - cron: "0 3 * * 1"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-tdlib:
+    runs-on: ubuntu-latest
+    env:
+      PACKAGE_NAME: tdlib
+      TDLIB_REPO: https://github.com/tdlib/td.git
+    steps:
+      - name: Check out repository
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          if command -v sudo >/dev/null 2>&1; then
+            SUDO=sudo
+          else
+            SUDO=
+          fi
+
+          $SUDO apt-get update
+          $SUDO apt-get install -y \
+            build-essential \
+            ca-certificates \
+            cmake \
+            curl \
+            git \
+            gperf \
+            libssl-dev \
+            pkg-config \
+            zlib1g-dev
+
+      - name: Resolve TDLib ref
+        id: tdlib
+        run: |
+          set -euo pipefail
+          ref="${{ inputs.tdlib_ref }}"
+          if [ -z "$ref" ]; then
+            ref="$(git ls-remote --tags --refs --sort='version:refname' "$TDLIB_REPO" 'v*' | tail -n1 | awk -F/ '{print $3}')"
+          fi
+          if [ -z "$ref" ]; then
+            echo "Failed to resolve TDLib ref" >&2
+            exit 1
+          fi
+
+          version="$ref"
+          version="${version#v}"
+          version="${version//\//-}"
+          archive="tdlib-${version}-linux-x86_64.tar.gz"
+
+          {
+            echo "ref=$ref"
+            echo "version=$version"
+            echo "archive=$archive"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build TDLib bundle
+        run: |
+          set -euo pipefail
+          ref="${{ steps.tdlib.outputs.ref }}"
+          version="${{ steps.tdlib.outputs.version }}"
+          archive="${{ steps.tdlib.outputs.archive }}"
+
+          rm -rf tdlib-src tdlib-build dist
+          git init tdlib-src
+          cd tdlib-src
+          git remote add origin "$TDLIB_REPO"
+          git fetch --depth 1 origin \
+            "refs/tags/${ref}:refs/tags/${ref}" \
+            "refs/heads/${ref}:refs/remotes/origin/${ref}" || true
+
+          if git rev-parse --verify --quiet "refs/tags/${ref}" >/dev/null; then
+            git checkout --detach "refs/tags/${ref}"
+          elif git rev-parse --verify --quiet "refs/remotes/origin/${ref}" >/dev/null; then
+            git checkout --detach "refs/remotes/origin/${ref}"
+          else
+            git fetch --depth 1 origin "$ref"
+            git checkout --detach FETCH_HEAD
+          fi
+          cd ..
+
+          cmake -S tdlib-src -B tdlib-build \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_INSTALL_PREFIX="$PWD/dist/tdlib" \
+            -DTD_ENABLE_INSTALL=ON \
+            -DTD_ENABLE_JNI=OFF \
+            -DTD_ENABLE_DOTNET=OFF \
+            -DTD_ENABLE_TESTS=OFF \
+            -DTD_ENABLE_BENCHMARKS=OFF
+          cmake --build tdlib-build -j"$(nproc)"
+          cmake --install tdlib-build
+
+          tar -C dist -czf "$archive" tdlib
+          sha256sum "$archive" > "${archive}.sha256"
+
+      - name: Publish TDLib package
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          version="${{ steps.tdlib.outputs.version }}"
+          archive="${{ steps.tdlib.outputs.archive }}"
+          base="${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/generic/${PACKAGE_NAME}"
+
+          status="$(curl --silent --show-error \
+            --output /dev/null \
+            --write-out "%{http_code}" \
+            --user "${{ gitea.actor }}:${GITEA_TOKEN}" \
+            -X DELETE \
+            "$base/$version")"
+          case "$status" in
+            204|404) ;;
+            *)
+              echo "Unexpected response deleting existing package version: $status" >&2
+              exit 1
+              ;;
+          esac
+
+          curl --fail-with-body \
+            --user "${{ gitea.actor }}:${GITEA_TOKEN}" \
+            --upload-file "$archive" \
+            "$base/$version/$archive"
+
+          curl --fail-with-body \
+            --user "${{ gitea.actor }}:${GITEA_TOKEN}" \
+            --upload-file "${archive}.sha256" \
+            "$base/$version/${archive}.sha256"
+
+      - name: Publish latest metadata
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          version="${{ steps.tdlib.outputs.version }}"
+          archive="${{ steps.tdlib.outputs.archive }}"
+          base="${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/generic/${PACKAGE_NAME}"
+          latest_manifest="tdlib-latest.json"
+
+          cat > "$latest_manifest" <<EOF
+          {
+            "ref": "${{ steps.tdlib.outputs.ref }}",
+            "version": "$version",
+            "archive": "$archive",
+            "url": "$base/$version/$archive",
+            "sha256_url": "$base/$version/${archive}.sha256"
+          }
+          EOF
+
+          status="$(curl --silent --show-error \
+            --output /dev/null \
+            --write-out "%{http_code}" \
+            --user "${{ gitea.actor }}:${GITEA_TOKEN}" \
+            -X DELETE \
+            "$base/latest")"
+          case "$status" in
+            204|404) ;;
+            *)
+              echo "Unexpected response deleting latest package version: $status" >&2
+              exit 1
+              ;;
+          esac
+
+          curl --fail-with-body \
+            --user "${{ gitea.actor }}:${GITEA_TOKEN}" \
+            --upload-file "$latest_manifest" \
+            "$base/latest/$latest_manifest"
diff --git a/scripts/package-tdlib.sh b/scripts/package-tdlib.sh
new file mode 100755
index 0000000..5c30aa1
--- /dev/null
+++ b/scripts/package-tdlib.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -lt 1 ] || [ "$#" -gt 2 ]; then
+  echo "usage: $0 <tdlib-root> [output-tar.gz]" >&2
+  exit 1
+fi
+
+tdlib_root="$(realpath "$1")"
+output_path="${2:-tdlib-linux-x86_64.tar.gz}"
+output_path="$(realpath -m "$output_path")"
+
+include_dir="$tdlib_root/include"
+lib_dir="$tdlib_root/lib"
+
+if [ ! -f "$include_dir/td/telegram/td_json_client.h" ]; then
+  echo "missing TDLib header: $include_dir/td/telegram/td_json_client.h" >&2
+  exit 1
+fi
+
+if ! compgen -G "$lib_dir/libtdjson.so*" >/dev/null; then
+  echo "missing TDLib shared library under: $lib_dir" >&2
+  exit 1
+fi
+
+workdir="$(mktemp -d)"
+trap 'rm -rf "$workdir"' EXIT
+
+mkdir -p "$workdir/tdlib"
+cp -a "$include_dir" "$workdir/tdlib/include"
+cp -a "$lib_dir" "$workdir/tdlib/lib"
+
+tar -C "$workdir" -czf "$output_path" tdlib
+sha256sum "$output_path" > "${output_path}.sha256"
+
+echo "wrote $output_path"
+echo "wrote ${output_path}.sha256"