diff --git a/vpn_node/scripts/publish.sh b/vpn_node/scripts/publish.sh
new file mode 100644
index 0000000..ebd2233
--- /dev/null
+++ b/vpn_node/scripts/publish.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mkdir -p /pkg/out
+nfpm package --config /pkg/nfpm.yaml --packager deb --target /pkg/out/
+echo "✓ built $(ls /pkg/out/*.deb)"
+
+DEB=$(ls /pkg/out/*.deb | head -1)
+FILENAME=$(basename "$DEB")
+
+DISTRIBUTION="bookworm"
+COMPONENT="main"
+
+echo "↑ publishing ${FILENAME}..."
+
+HTTP_CODE=$(curl -sSL \
+  -w "%{http_code}" \
+  -o /tmp/publish_response.txt \
+  -X PUT \
+  -H "Authorization: token ${GITEA_TOKEN}" \
+  -H "Content-Type: application/octet-stream" \
+  --data-binary "@${DEB}" \
+  "${GITEA_URL}/api/packages/${GITEA_OWNER}/debian/pool/${DISTRIBUTION}/${COMPONENT}/upload")
+
+cat /tmp/publish_response.txt
+echo ""
+
+if [[ "$HTTP_CODE" =~ ^2 ]]; then
+  echo "✓ published ${FILENAME} (HTTP ${HTTP_CODE})"
+elif [[ "$HTTP_CODE" == "409" ]]; then
+  echo "⚠ ${FILENAME} already exists, skipping (HTTP 409)"
+else
+  echo "✗ failed (HTTP ${HTTP_CODE})"
+  exit 1
+fi