diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..4685e1d
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,103 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+    branches: [main]
+
+env:
+  # The OpenAC release whose AcDream.Plugin.Abstractions package this plugin
+  # builds against. PluginApiPackageVersion in Directory.Build.props has to
+  # name the same version.
+  OPENAC_API_RELEASE_TAG: v0.1.19
+  OPENAC_API_VERSION: 0.1.19
+
+jobs:
+  build-and-test:
+    runs-on: docker
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install the pinned .NET SDK
+        uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Fetch the plugin contract package
+        run: |
+          set -euo pipefail
+          mkdir -p packages-local
+          curl -fsSL -o "packages-local/AcDream.Plugin.Abstractions.${OPENAC_API_VERSION}.nupkg" \
+            "https://github.com/eriknihlen/OpenAC/releases/download/${OPENAC_API_RELEASE_TAG}/AcDream.Plugin.Abstractions.${OPENAC_API_VERSION}.nupkg"
+
+      - name: Build
+        run: dotnet build OpenAC.MosswartMassacre.slnx -c Release --nologo
+
+      - name: Test
+        run: dotnet test OpenAC.MosswartMassacre.slnx -c Release --no-build --nologo
+
+  release:
+    # Tag pushes only, once the build and tests are green.
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [build-and-test]
+    runs-on: docker
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install the pinned .NET SDK
+        uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Fetch the plugin contract package
+        run: |
+          set -euo pipefail
+          mkdir -p packages-local
+          curl -fsSL -o "packages-local/AcDream.Plugin.Abstractions.${OPENAC_API_VERSION}.nupkg" \
+            "https://github.com/eriknihlen/OpenAC/releases/download/${OPENAC_API_RELEASE_TAG}/AcDream.Plugin.Abstractions.${OPENAC_API_VERSION}.nupkg"
+
+      - name: Build
+        run: dotnet build OpenAC.MosswartMassacre.slnx -c Release --nologo
+
+      - name: Assemble the release assets
+        run: |
+          set -euo pipefail
+          bash tools/build-release-zip.sh Release artifacts | tee build-zip.out
+          cat build-zip.out >> "$GITHUB_ENV"
+
+      # The tag is the version the release is known by; the manifest's version
+      # is what an install reads. They have to agree.
+      - name: The tag has to name the manifest's version
+        run: |
+          set -euo pipefail
+          if [ "${GITHUB_REF_NAME}" != "v${version}" ]; then
+            echo "Tag '${GITHUB_REF_NAME}' does not name the manifest version (v${version})." >&2
+            exit 1
+          fi
+
+      # acdream-plugincheck is the OpenAC launcher's own install code, built
+      # from the same OpenAC release the contract package comes from.
+      - name: Check the zip with the launcher's own install code
+        run: |
+          set -euo pipefail
+          git clone --quiet --depth 1 --branch "$OPENAC_API_RELEASE_TAG" https://github.com/eriknihlen/OpenAC.git .openac
+          dotnet run --project .openac/src/AcDream.PluginCheck -c Release -- "$zip"
+
+      - name: Publish the release
+        env:
+          TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+        run: |
+          set -euo pipefail
+          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          body=$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "name": "Mosswart Massacre " + sys.argv[1]}))' "$GITHUB_REF_NAME")
+          id=$(curl -fsS -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+            -d "$body" "$api/releases" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
+          for file in artifacts/plugin.json artifacts/*.zip artifacts/*.zip.sha256; do
+            curl -fsS -X POST -H "Authorization: token $TOKEN" \
+              -F "attachment=@${file}" "$api/releases/${id}/assets?name=$(basename "$file")" > /dev/null
+            echo "uploaded $(basename "$file")"
+          done
diff --git a/src/OpenAC.MosswartMassacre/plugin.json b/src/OpenAC.MosswartMassacre/plugin.json
index 44fc070..47694d1 100644
--- a/src/OpenAC.MosswartMassacre/plugin.json
+++ b/src/OpenAC.MosswartMassacre/plugin.json
@@ -9,7 +9,7 @@
   "minHostVersion": "0.1.19",
   "capabilitiesVersion": 1,
   "capabilities": [
-    { "name": "network", "note": "Streams telemetry, vitals, chat, inventory and stats to the Mosswart Overlord backend, and receives shared vitals and chat-box commands from it." },
-    { "name": "chat", "note": "Reads chat for kills, rares and combat stats, forwards it to the backend, and runs commands typed into the Overlord chat box." }
+    { "name": "network", "note": "Streams stats, vitals, chat and inventory to Mosswart Overlord, and receives shared vitals and commands from it." },
+    { "name": "chat", "note": "Reads chat for kills, rares and combat stats, forwards it to Overlord, and runs commands sent from its chat box." }
   ]
 }
diff --git a/tests/OpenAC.MosswartMassacre.Tests/Backend/TestSocketServer.cs b/tests/OpenAC.MosswartMassacre.Tests/Backend/TestSocketServer.cs
index 6ac58d6..7ee2790 100644
--- a/tests/OpenAC.MosswartMassacre.Tests/Backend/TestSocketServer.cs
+++ b/tests/OpenAC.MosswartMassacre.Tests/Backend/TestSocketServer.cs
@@ -17,6 +17,7 @@ internal sealed class TestSocketServer : IDisposable
     private readonly CancellationTokenSource _cts = new();
     private readonly Task _accept;
     private WebSocket? _current;
+    private HttpListenerContext? _currentContext;
 
     public TestSocketServer()
     {
@@ -53,7 +54,12 @@ internal sealed class TestSocketServer : IDisposable
     {
         WebSocket socket = await WaitForSocketAsync();
         socket.Abort();
+        // Aborting the socket alone leaves the TCP connection open on some
+        // platforms' listeners, so the client never sees the drop; ending the
+        // response closes the connection everywhere, as a real server's drop does.
+        _currentContext?.Response.Abort();
         _current = null;
+        _currentContext = null;
     }
 
     public string NextFrame(int timeoutMs = 5000)
@@ -111,6 +117,7 @@ internal sealed class TestSocketServer : IDisposable
             Secrets.Enqueue(context.Request.Headers["X-Plugin-Secret"]);
             HttpListenerWebSocketContext ws = await context.AcceptWebSocketAsync(null);
             _current = ws.WebSocket;
+            _currentContext = context;
             _ = Task.Run(() => ReadLoopAsync(ws.WebSocket));
         }
     }
diff --git a/tools/build-release-zip.sh b/tools/build-release-zip.sh
new file mode 100755
index 0000000..9e37d58
--- /dev/null
+++ b/tools/build-release-zip.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Assembles the plugin release zip and its .sha256 sidecar from a Release build.
+#
+# The layout is the one the OpenAC launcher's installer accepts:
+# - plugin.json and the entry DLL sit at the zip root;
+# - only these extensions: .dll .pdb .json .xml .txt .md .png .jpg .jpeg .ttf .otf;
+# - no runtimes/ folder, and no AcDream assembly beside the plugin's own;
+# - the plugin.json published as its own release asset is the same file as the
+#   zip's copy;
+# - the sidecar is `sha256sum`'s line: the hash, two spaces, the zip's name.
+# Asset names are <id>-<version>.zip and <id>-<version>.zip.sha256.
+set -euo pipefail
+
+configuration="${1:-Release}"
+output="${2:-artifacts}"
+repo="$(cd "$(dirname "$0")/.." && pwd)"
+build="$repo/src/OpenAC.MosswartMassacre/bin/$configuration/net10.0"
+
+[ -d "$build" ] || { echo "No build output at $build. Build the solution first." >&2; exit 1; }
+
+read_field() {
+  python3 -c 'import json,sys; print(json.load(open(sys.argv[1], encoding="utf-8-sig"))[sys.argv[2]])' "$build/plugin.json" "$1"
+}
+id="$(read_field id)"
+version="$(read_field version)"
+entry="$(read_field entryDll)"
+stem="${entry%.dll}"
+
+staging="$(mktemp -d)"
+trap 'rm -rf "$staging"' EXIT
+
+for name in plugin.json "$entry" "$stem.pdb" "$stem.deps.json" Newtonsoft.Json.dll; do
+  [ -f "$build/$name" ] || { echo "The build output has no '$name'." >&2; exit 1; }
+  cp "$build/$name" "$staging/"
+done
+cp "$build"/mosswartmassacre-*.xml "$staging/"
+
+for file in "$staging"/*; do
+  name="$(basename "$file")"
+  case "${name,,}" in
+    *.dll|*.pdb|*.json|*.xml|*.txt|*.md|*.png|*.jpg|*.jpeg|*.ttf|*.otf) ;;
+    *) echo "'$name' has an extension the launcher refuses." >&2; exit 1 ;;
+  esac
+  if [[ "$name" == AcDream.*.dll ]]; then
+    echo "'$name' is a client assembly beside the plugin." >&2; exit 1
+  fi
+done
+
+mkdir -p "$repo/$output"
+zip="$repo/$output/$id-$version.zip"
+rm -f "$zip"
+python3 - "$staging" "$zip" <<'PY'
+import os, sys, zipfile
+src, dst = sys.argv[1], sys.argv[2]
+with zipfile.ZipFile(dst, "w", zipfile.ZIP_DEFLATED) as z:
+    for name in sorted(os.listdir(src)):
+        z.write(os.path.join(src, name), name)
+PY
+(cd "$repo/$output" && sha256sum "$id-$version.zip" > "$id-$version.zip.sha256")
+cp "$build/plugin.json" "$repo/$output/plugin.json"
+
+echo "zip=$zip"
+echo "version=$version"