diff --git a/.forgejo/workflows/test.yaml b/.forgejo/workflows/test.yaml
index c52647e..df39979 100644
--- a/.forgejo/workflows/test.yaml
+++ b/.forgejo/workflows/test.yaml
@@ -48,3 +48,45 @@ jobs:
         uses: https://git.jcollie.dev/jeff/niks3-push@3f85f501658e379783381291241c6f8315a92716
         with:
           server-url: https://niks3.jcollie.dev
+
+  # Published only from main, and only after `test` has passed, so that a
+  # branch cannot replace the source and a failing change never reaches it.
+  publish:
+    needs: test
+    if: ${{ forge.ref == 'refs/heads/main' }}
+    runs-on: nixos-do-s
+    enable-openid-connect: true
+    steps:
+      - name: Check out
+        uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # The key exists only in this step's temporary directory, and the
+      # signature is verified against the published certificate before
+      # anything is uploaded.
+      - name: Build and sign
+        env:
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+        run: |
+          umask 077
+          keys=$(mktemp -d)
+          trap 'rm -rf "$keys"' EXIT
+          printf '%s\n' "$SIGNING_KEY" > "$keys/signing.key"
+          nix develop -c openssl x509 -inform der -in certificate/JCOllie.cer -out "$keys/signing.pem"
+          nix develop -c python3 -m wingetsource build \
+            --manifests manifests --out _site \
+            --certificate certificate/JCOllie.cer \
+            --certificate-pem "$keys/signing.pem" --key "$keys/signing.key"
+          nix develop -c osslsigncode verify -CAfile "$keys/signing.pem" -in _site/source.msix
+
+      - name: Publish
+        run: >
+          nix develop -c git-pages-cli https://winget.jcollie.dev/
+          --server jcollie.page
+          --token ${{ forge.token }}
+          --upload-dir _site
+
+      - name: Push to the cache
+        if: ${{ !cancelled() }}
+        uses: https://git.jcollie.dev/jeff/niks3-push@3f85f501658e379783381291241c6f8315a92716
+        with:
+          server-url: https://niks3.jcollie.dev