diff --git a/.gitea/workflows/bundle.yml b/.gitea/workflows/bundle.yml
index 7362de5..894fc38 100644
--- a/.gitea/workflows/bundle.yml
+++ b/.gitea/workflows/bundle.yml
@@ -26,14 +26,70 @@ jobs:
         run: |
           bash scripts/bundle.sh
 
-      - name: Push (if bundle update commit was created)
+      - name: Push + tag + create release with filtered bundle (if bundle update commit was created)
         env:
           HAXBOT_TOKEN: ${{ secrets.HAXBOT_TOKEN }}
         run: |
+          set -euo pipefail
+
           if git log -1 --pretty=%B | grep -q '^bundle: update'; then
-            REPO_URL="https://x-access-token:${HAXBOT_TOKEN}@git.knoxmakers.org/KnoxMakers/knoxmakers-inkscape.git"
+            OWNER="KnoxMakers"
+            REPO="knoxmakers-inkscape"
+            BASE_URL="https://git.knoxmakers.org"
+
+            # Authenticated push URL (PAT belongs to haxbot)
+            REPO_URL="https://x-access-token:${HAXBOT_TOKEN}@git.knoxmakers.org/${OWNER}/${REPO}.git"
             git remote set-url origin "$REPO_URL"
+
+            # Push the commit to main
             git push origin HEAD:main
+
+            # Create a unique tag for this bundle run
+            TAG="bundle-$(date -u +%Y%m%d-%H%M%S)"
+            SHA="$(git rev-parse HEAD)"
+
+            git tag -a "$TAG" -m "Automated bundle: $TAG ($SHA)"
+            git push origin "$TAG"
+
+            # Build a release artifact: include everything except scripts/ and .gitea/ and .git/
+            ART="knoxmakers-inkscape-${TAG}.zip"
+            rm -f "$ART"
+
+            zip -r "$ART" . \
+              -x "scripts/*" \
+              -x ".gitea/*" \
+              -x ".git/*"
+
+            # Create a Gitea Release for the tag
+            API_CREATE="${BASE_URL}/api/v1/repos/${OWNER}/${REPO}/releases"
+
+            CREATE_JSON="$(jq -n \
+              --arg tag "$TAG" \
+              --arg name "$TAG" \
+              --arg body "Automated bundle release.\n\nExcludes: scripts/, .gitea/\nCommit: $SHA\nUTC: $(date -u +'%Y-%m-%d %H:%M:%S')" \
+              '{tag_name:$tag, name:$name, body:$body, draft:false, prerelease:false}')"
+
+            RELEASE_RESP="$(curl -fsS -X POST "$API_CREATE" \
+              -H "Authorization: token ${HAXBOT_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "$CREATE_JSON")"
+
+            RELEASE_ID="$(printf '%s' "$RELEASE_RESP" | jq -r '.id')"
+            if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "null" ]; then
+              echo "Failed to parse release id. Response:"
+              echo "$RELEASE_RESP"
+              exit 1
+            fi
+
+            # Upload the bundle as a release asset
+            API_UPLOAD="${BASE_URL}/api/v1/repos/${OWNER}/${REPO}/releases/${RELEASE_ID}/assets?name=$(printf '%s' "$ART" | jq -sRr @uri)"
+
+            curl -fsS -X POST "$API_UPLOAD" \
+              -H "Authorization: token ${HAXBOT_TOKEN}" \
+              -H "Content-Type: multipart/form-data" \
+              -F "attachment=@${ART};type=application/zip"
+
+            echo "Release created: $TAG (id=$RELEASE_ID) with asset: $ART"
           else
             echo "No update commit created."
           fi