diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 97833af..5db5202 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,8 +1,9 @@
 name: CI
 
 # Checks run on every push and PR. Pushes to main and v* tags build and package
-# the plugin, then publish the .ndp artifact to pkgs.daubney.dev - but only
-# once every check has passed. Every run is reported to ntfy.
+# the plugin, then publish the .ndp artifact to both this repo's Gitea package
+# registry and pkgs.daubney.dev - but only once every check has passed. Every
+# run is reported to ntfy.
 on:
   push:
     branches: ["**"]
@@ -64,6 +65,9 @@ jobs:
     needs: [lint, test, build]
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
@@ -84,6 +88,30 @@ jobs:
               --data-binary "@manifest.json" "$BASE/$dir/manifest.json"
             echo "uploaded $dir/${PLUGIN_ID}.ndp"
           done
+      - name: Upload plugin artifact to Gitea package registry
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          BASE: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/generic/${{ env.PLUGIN_ID }}
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then dirs="${GITHUB_REF_NAME#v}"; else dirs="main sha-${GITHUB_SHA::7}"; fi
+          # Generic packages are immutable per version: delete first (ignored if absent) so
+          # a re-run or a repeated push to a mutable version like "main" doesn't 409.
+          for dir in $dirs; do
+            curl -fsS -X DELETE -H "Authorization: token $GITEA_TOKEN" "$BASE/$dir" || true
+            curl -fsS -X PUT -H "Authorization: token $GITEA_TOKEN" \
+              --upload-file "dist/${PLUGIN_ID}.ndp" "$BASE/$dir/${PLUGIN_ID}.ndp"
+            curl -fsS -X PUT -H "Authorization: token $GITEA_TOKEN" \
+              --upload-file "manifest.json" "$BASE/$dir/manifest.json"
+            echo "uploaded $dir/${PLUGIN_ID}.ndp to Gitea packages"
+          done
+      - name: Link Gitea package to this repo
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          repo_name="${GITHUB_REPOSITORY#*/}"
+          curl -fsS -X POST -H "Authorization: token $GITEA_TOKEN" \
+            "${{ github.server_url }}/api/v1/packages/${{ github.repository_owner }}/generic/${{ env.PLUGIN_ID }}/-/link/$repo_name" \
+            || echo "link skipped (already linked, or not yet supported)"
 
   notify:
     needs: [lint, test, build, publish]
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..d04b9a0
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, Matt Daubney
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/README.md b/README.md
index 2200f50..c4345cc 100644
--- a/README.md
+++ b/README.md
@@ -90,7 +90,12 @@ then configure and assign users as described above.
 ## CI/CD
 
 Gitea Actions (`.gitea/workflows/ci.yml`) lints and tests every push and pull
-request, builds and packages the `.ndp` on every push, and — on pushes to
-`main` or `v*` tags — publishes the built artifact to the same
+request, builds, packages and validates the `.ndp` on every push, and — on
+pushes to `main` or `v*` tags — publishes the built artifact both to this
+repo's own Gitea package registry and to the same
 [pkgs.daubney.dev](https://pkgs.daubney.dev) ProGet asset feed used by
 `ScrobblingService`, under the `navidrome-scrobbled` content path.
+
+## License
+
+BSD 3-Clause. See [LICENSE](LICENSE).
diff --git a/pyproject.toml b/pyproject.toml
index c6a440a..10a7794 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -2,6 +2,8 @@
 name = "navidromescrobbledplugin"
 version = "0.1.0"
 requires-python = ">=3.13"
+license = "BSD-3-Clause"
+license-files = ["LICENSE"]
 dependencies = []
 
 [dependency-groups]