diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1d0263f92..db3ec874a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -143,6 +143,63 @@ jobs:
           append_body: true
           body: ${{ steps.sponsors.outputs.body }}
 
+  build-deb:
+    needs: build-binary
+    runs-on: [self-hosted, Linux, X64, appimage]
+    permissions:
+      contents: write
+
+    env:
+      BUILD_TYPE: Release
+      INSTALL_DIR: ${{ github.workspace }}/install
+      VERSION: ${{ needs.build-binary.outputs.tag }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build-binary.outputs.tag }}
+
+      - name: Install nfpm
+        run: |-
+          sudo mkdir -p /etc/apt/keyrings
+          curl -fsSL https://repo.goreleaser.com/apt/gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/goreleaser-archive-keyring.gpg
+          echo 'deb [signed-by=/etc/apt/keyrings/goreleaser-archive-keyring.gpg] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
+          sudo apt-get update -y
+          sudo apt-get install -y nfpm
+
+      - name: Prepare dirs
+        run: mkdir -p build install
+
+      - name: Configure CMake
+        run: |
+          cd build
+          cmake -G Ninja ..                           \
+            -DCMAKE_BUILD_TYPE=${BUILD_TYPE}          \
+            -DCMAKE_POLICY_VERSION_MINIMUM=3.5        \
+            -DCMAKE_INSTALL_PREFIX="${INSTALL_DIR}"   \
+            -DVICINAE_PROVENANCE=deb                  \
+            -DLTO=ON
+
+      - name: Build
+        run: |
+          cmake --build build --config ${BUILD_TYPE} --parallel $(nproc)
+
+      - name: Install
+        run: |
+          cmake --install build
+
+      - name: Make Deb Package
+        run: ./scripts/mkdeb.sh
+
+      - name: Upload Deb to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ needs.build-binary.outputs.tag }}
+          name: ${{ needs.build-binary.outputs.tag }}
+          files: |
+            *.deb
 
   build-appimage:
     needs: build-binary
@@ -204,4 +261,3 @@ jobs:
           GH_TOKEN: ${{ secrets.PACKAGING_AUR_TOKEN }}
         run: |
           gh workflow run bumpver.yml --repo vicinaehq/packaging-arch
-
diff --git a/nfpm.yaml b/nfpm.yaml
new file mode 100644
index 000000000..63d22a8f1
--- /dev/null
+++ b/nfpm.yaml
@@ -0,0 +1,37 @@
+name: vicinae
+arch: amd64
+platform: linux
+version: ${VERSION}
+maintainer: "Aurelien Brabant <gh@aurelle.dev>"
+homepage: https://github.com/vicinaehq/vicinae
+license: GPL-3.0
+depends:
+  - layer-shell-qt
+  - protobuf-compiler
+  - libqt6concurrent6
+  - libqt6sql6-sqlite
+  - cmark
+  - cmark-gfm
+  - qml6-module-qtquick-dialogs
+  - minizip
+  - nodejs
+  - npm
+contents:
+  - src: install/bin/vicinae
+    dst: /usr/bin/vicinae
+  - src: install/libexec/vicinae/vicinae-*
+    dst: /usr/libexec/vicinae/
+
+  - src: extra/vicinae.desktop
+    dst: /usr/share/applications/vicinae.desktop
+  - src: extra/vicinae-url-handler.desktop
+    dst: /usr/share/applications/vicinae-url-handler.desktop
+  - src: extra/vicinae.service
+    dst: /usr/lib/systemd/user/vicinae.service
+  - src: extra/vicinae.png
+    dst: /usr/share/icons/hicolor/512x512/apps/vicinae.png
+  - src: extra/modules-load.d/vicinae.conf
+    dst: /usr/lib/modules-load.d/vicinae.conf
+
+  - src: extra/themes
+    dst: /usr/share/vicinae/themes
diff --git a/scripts/mkdeb.sh b/scripts/mkdeb.sh
new file mode 100755
index 000000000..1fe51d9fd
--- /dev/null
+++ b/scripts/mkdeb.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+#
+# Builds debian packages, assumes binaries have already been built.
+
+set -euo pipefail
+
+VERSION="${VERSION:-""}"
+if [[ -z "$VERSION" ]]; then
+  echo "Error: Missing env var VERSION" >&2
+  exit 1
+fi
+
+VERSION="${VERSION#v}"
+
+BUILD_DIR="${BUILD_DIR:-"$(pwd)/build"}"
+INSTALL_DIR="${INSTALL_DIR:-"$(pwd)/install"}"
+if [[ ! -e "$BUILD_DIR/bin/vicinae" && ! -e "$INSTALL_DIR/bin/vicinae" ]]; then
+  echo "Error: Missing expected build artifacts at \"$BUILD_DIR/bin/vicinae\" or \"$INSTALL_DIR/bin/vicinae\" (was vicinae built and installed?)" >&2
+  exit 1
+fi
+
+if ! command -v nfpm &>/dev/null; then
+  echo "Error: nfpm is missing, please install it:" >&2
+  echo "       https://nfpm.goreleaser.com/docs/install/" >&2
+  exit 1
+fi
+
+exec nfpm package -p deb