diff --git a/.github/workflows/release-electron.yml b/.github/workflows/release-electron.yml
new file mode 100644
index 00000000..8339cde3
--- /dev/null
+++ b/.github/workflows/release-electron.yml
@@ -0,0 +1,39 @@
+# Builds Linux AppImage + deb and attaches them to a GitHub Release when you push a tag like v19.2.3
+name: Release Electron (Linux)
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  linux:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build & pack
+        run: npm run electron:pack
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload artifacts to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            release/*.AppImage
+            release/*.deb
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/package-lock.json b/package-lock.json
index 9ca8868a..4cf739a0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "jumble-imwald",
-  "version": "19.2.2",
+  "version": "19.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jumble-imwald",
-      "version": "19.2.2",
+      "version": "19.3.0",
       "license": "MIT",
       "dependencies": {
         "@asciidoctor/core": "^3.0.4",
diff --git a/package.json b/package.json
index 282d4edd..0336344a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jumble-imwald",
-  "version": "19.2.2",
+  "version": "19.3.0",
   "description": "A user-friendly Nostr client focused on relay feed browsing and relay discovery, forked from Jumble",
   "private": true,
   "type": "module",
diff --git a/scripts/build-and-push-prod.sh b/scripts/build-and-push-prod.sh
index 85c242d0..b29994e9 100755
--- a/scripts/build-and-push-prod.sh
+++ b/scripts/build-and-push-prod.sh
@@ -1,12 +1,14 @@
 #!/usr/bin/env bash
 # Build main app and NIP-66 monitor images locally; push to silberengel/imwald-jumble and silberengel/imwald-jumble-nip66-monitor as :latest and :<version from package.json>.
-# Run from repo root. Requires: docker, docker login. On the server you then pull and run docker-compose.prod.yml.
+# Then create git tag v<version> and push it (e.g. to trigger release workflows).
+# Run from repo root. Requires: docker, docker login, git.
 set -e
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$REPO_ROOT"
 
 VERSION="$(node -p "require('./package.json').version")"
+GIT_TAG="v${VERSION}"
 IMAGE_APP="silberengel/imwald-jumble"
 IMAGE_MONITOR="silberengel/imwald-jumble-nip66-monitor"
 
@@ -22,4 +24,22 @@ docker push "$IMAGE_APP:$VERSION"
 docker push "$IMAGE_MONITOR:latest"
 docker push "$IMAGE_MONITOR:$VERSION"
 
+# --- Git tag (matches package.json version) ---
+if git rev-parse "$GIT_TAG" >/dev/null 2>&1; then
+  echo "Tag $GIT_TAG already exists locally. Bump version in package.json or delete the tag." >&2
+  exit 1
+fi
+
+if git ls-remote origin "refs/tags/$GIT_TAG" | grep -q .; then
+  echo "Tag $GIT_TAG already exists on origin. Bump version in package.json or delete the remote tag." >&2
+  exit 1
+fi
+
+echo "Creating annotated tag $GIT_TAG at HEAD"
+git tag -a "$GIT_TAG" -m "Release $GIT_TAG"
+
+echo "Pushing tag $GIT_TAG to origin"
+git push origin "$GIT_TAG"
+
 echo "Done. On the server: docker compose -f docker-compose.prod.yml pull && docker compose -f docker-compose.prod.yml up -d"
+echo "If .github/workflows/release-electron.yml is enabled, Linux AppImage/deb will attach when the workflow finishes."