diff --git a/.drone.yml b/.drone.yml
new file mode 100644
index 0000000..4071729
--- /dev/null
+++ b/.drone.yml
@@ -0,0 +1,49 @@
+kind: pipeline
+type: docker
+name: release
+
+trigger:
+  event:
+    - tag
+  ref:
+    include:
+      - refs/tags/v*
+
+steps:
+  - name: build
+    image: golang:1.26
+    environment:
+      CGO_ENABLED: "0"
+    commands:
+      - mkdir -p dist/linux-amd64 dist/darwin-arm64 dist/windows-amd64
+      - GOOS=linux   GOARCH=amd64 go build -trimpath -ldflags "-s -w -X gitea.epss.net.cn/klesh/ss/internal/cli.Version=${DRONE_TAG}" -o dist/linux-amd64/ss       ./cmd/ss
+      - GOOS=darwin  GOARCH=arm64 go build -trimpath -ldflags "-s -w -X gitea.epss.net.cn/klesh/ss/internal/cli.Version=${DRONE_TAG}" -o dist/darwin-arm64/ss      ./cmd/ss
+      - GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "-s -w -X gitea.epss.net.cn/klesh/ss/internal/cli.Version=${DRONE_TAG}" -o dist/windows-amd64/ss.exe ./cmd/ss
+
+  - name: package
+    image: golang:1.26
+    commands:
+      - apt-get update -qq && apt-get install -qq -y zip > /dev/null
+      - cd dist
+      - tar -C linux-amd64   -czf ss-${DRONE_TAG}-linux-amd64.tar.gz   ss
+      - tar -C darwin-arm64  -czf ss-${DRONE_TAG}-darwin-arm64.tar.gz  ss
+      - (cd windows-amd64 && zip -q ../ss-${DRONE_TAG}-windows-amd64.zip ss.exe)
+      - sha256sum ss-${DRONE_TAG}-linux-amd64.tar.gz ss-${DRONE_TAG}-darwin-arm64.tar.gz ss-${DRONE_TAG}-windows-amd64.zip > checksums.txt
+      - rm -rf linux-amd64 darwin-arm64 windows-amd64
+      - ls -la
+    depends_on:
+      - build
+
+  - name: gitea-release
+    image: plugins/gitea-release
+    settings:
+      base_url: https://gitea.epss.net.cn
+      api_key:
+        from_secret: drone_release
+      files:
+        - dist/*
+      title: ${DRONE_TAG}
+      checksum:
+        - sha256
+    depends_on:
+      - package
diff --git a/internal/cli/root.go b/internal/cli/root.go
index 5a57fbd..270bc8c 100644
--- a/internal/cli/root.go
+++ b/internal/cli/root.go
@@ -59,11 +59,17 @@ func newManagers(configFile, outputFile, subscriptionName string) (*managers, er
 	}, nil
 }
 
+// Version is the ss build version, injected at build time via
+// -ldflags "-X gitea.epss.net.cn/klesh/ss/internal/cli.Version=vX.Y.Z"
+// (see .drone.yml). Defaults to "dev" for local/unversioned builds.
+var Version = "dev"
+
 // Execute runs the ss CLI. It is the Go equivalent of cli.py's main().
 func Execute() {
 	root := &cobra.Command{
 		Use:           "ss",
 		Short:         "Scientific Surfing - CLI for managing clash RSS subscriptions",
+		Version:       Version,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 	}