diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 653428d..dfc9d45 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,13 @@ jobs:
       - run: ./dependencies.sh
       - run: make
       - run: make test
+      - run: make deb
+      - run: dpkg -i build/*.deb
+      - run: wgwatch --help
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wgwatch-deb
+          path: build/*.deb
 
   fedora:
     runs-on: ubuntu-latest
@@ -22,6 +29,13 @@ jobs:
       - run: ./dependencies.sh
       - run: make
       - run: make test
+      - run: make rpm
+      - run: dnf install -y ./build/*.rpm
+      - run: wgwatch --help
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wgwatch-rpm
+          path: build/*.rpm
 
   nix-shell:
     runs-on: ubuntu-latest
@@ -39,3 +53,22 @@ jobs:
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: nix build .#default
       - run: ./result/bin/wgwatch --help
+
+  release:
+    needs: [debian, fedora]
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: wgwatch-deb
+      - uses: actions/download-artifact@v4
+        with:
+          name: wgwatch-rpm
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            *.deb
+            *.rpm
diff --git a/.gitignore b/.gitignore
index c7c6d3d..e260565 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,6 @@
 .envrc
 *~
 *.log
+*.deb
+*.rpm
+state-*
diff --git a/CMakeLists.txt b/CMakeLists.txt
index c0d9cec..9c0bfa6 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -35,3 +35,14 @@ install(TARGETS wgwatch DESTINATION bin)
 
 enable_testing()
 add_subdirectory(tests)
+
+# Binary packages via `make deb` / `make rpm` (cpack -G DEB/RPM).
+# Runtime deps: DEB via dpkg-shlibdeps, RPM via rpmbuild auto-Requires.
+set(CPACK_PACKAGE_NAME "wgwatch")
+set(CPACK_PACKAGE_VERSION "${PROJECT_VERSION}")
+set(CPACK_PACKAGE_CONTACT "bartman")
+set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "Top-like WireGuard monitor")
+set(CPACK_DEBIAN_PACKAGE_SHLIBDEPS ON)
+set(CPACK_DEBIAN_FILE_NAME "DEB-DEFAULT")
+set(CPACK_RPM_FILE_NAME "RPM-DEFAULT")
+include(CPack)
diff --git a/Makefile b/Makefile
index 42d135a..e34273c 100644
--- a/Makefile
+++ b/Makefile
@@ -30,7 +30,7 @@ else
 $(error TYPE must be release or debug (got '$(TYPE)'))
 endif
 
-.PHONY: all clean distclean test install help config
+.PHONY: all clean distclean test install deb rpm help config
 
 all: config
 	cmake --build $(BUILD)
@@ -57,6 +57,12 @@ test: all
 install: all
 	cmake --install $(BUILD) --prefix $(HOME)/.local
 
+deb: all
+	cmake -E chdir $(BUILD) cpack -G DEB
+
+rpm: all
+	cmake -E chdir $(BUILD) cpack -G RPM
+
 help:
 	@echo "targets:"
 	@echo "  all            build the project (default)"
@@ -64,6 +70,8 @@ help:
 	@echo "  distclean      remove BUILD directory"
 	@echo "  test           run unit tests"
 	@echo "  install        install binary in ~/.local/bin"
+	@echo "  deb            build .deb package (Debian)"
+	@echo "  rpm            build .rpm package (Fedora)"
 	@echo ""
 	@echo "variables:"
 	@echo "  BUILD=build    use a different build directory"
diff --git a/README.md b/README.md
index 3d4325b..0c09221 100644
--- a/README.md
+++ b/README.md
@@ -56,6 +56,23 @@ Use wgwatch from your own flake / NixOS config:
 Without flakes: `nix-build` puts the binary at `./result/bin/wgwatch`
 (see `default.nix`).
 
+## Packages
+
+Automated .deb and .rpm builds are available for download and manual install.
+These have not been thoroughly tested.
+
+https://github.com/bartman/wgwatch/releases/latest
+
+On Debian based systems (from the download directory):
+```sh
+sudo apt install ./wgwatch_0.1.0_amd64.deb
+```
+
+On Fedora based systems (from the download directory):
+```sh
+sudo dnf install ./wgwatch-0.1.0-1.x86_64.rpm
+```
+
 ## Options
 
 ```sh
diff --git a/dependencies.sh b/dependencies.sh
index 54e66c8..cb776b4 100755
--- a/dependencies.sh
+++ b/dependencies.sh
@@ -12,11 +12,11 @@ fi
 
 if command -v apt-get >/dev/null 2>&1; then
   $SUDO apt-get update && $SUDO apt-get install -y \
-    clang g++ cmake ninja-build pkg-config git ca-certificates \
+    clang g++ cmake ninja-build pkg-config git ca-certificates dpkg-dev file \
     libev-dev libfmt-dev libspdlog-dev libgtest-dev
 elif command -v dnf >/dev/null 2>&1; then
   $SUDO dnf install -y \
-    clang gcc-c++ cmake ninja-build pkg-config git ca-certificates \
+    clang gcc-c++ cmake ninja-build pkg-config git ca-certificates rpm-build \
     libev-devel fmt-devel spdlog-devel gtest-devel
 else
   msg "no apt-get/dnf found; skipping (use nix develop for deps)"