diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 000000000..f54ae1179
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,50 @@
+name: build and publish packages
+
+# STUB — wired in a follow-up session. Current design sketch:
+#
+#   jobs:
+#     arch-aarch64:
+#       runs-on: [self-hosted, alarm, aarch64]
+#       steps:
+#         - uses: actions/checkout@v4
+#         - name: makepkg
+#           run: |
+#             cd arch/distcc-avahi
+#             makepkg --nocheck --noconfirm --syncdeps
+#         - name: import signing key
+#           env:
+#             KEY: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
+#             PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
+#           run: |
+#             echo "$KEY" | gpg --import
+#             echo "$PASS" > /tmp/pass
+#         - name: sign package
+#           run: |
+#             gpg --batch --pinentry-mode loopback --passphrase-file /tmp/pass \
+#                 --detach-sign --yes arch/distcc-avahi/*.pkg.tar.zst
+#         - name: publish to packages.reauktion.de
+#           env:
+#             SSH_KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
+#           run: |
+#             mkdir -p ~/.ssh && echo "$SSH_KEY" > ~/.ssh/id_ed25519
+#             chmod 600 ~/.ssh/id_ed25519
+#             scp arch/distcc-avahi/*.pkg.tar.zst{,.sig} \
+#                 mfritsche@nc.reauktion.de:/srv/packages/arch/aarch64/
+#             # Regenerate db remotely (on an aarch64 runner with pacman):
+#             ssh mfritsche@nc.reauktion.de 'cd /srv/packages/arch/aarch64 && \
+#                 repo-add --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+#                 marfrit.db.tar.gz *.pkg.tar.zst'
+#
+# Runner requirements:
+#   - feynman (CT115 on data) currently has the Actions runner for ARM
+#     bare-metal builds. For ALARM packages we'd want either:
+#       (a) a dedicated ALARM runner container, OR
+#       (b) makechrootpkg inside feynman with an ALARM pacstrap.
+#   - x86_64 Arch runner: can live on any nuccie.
+#   - Debian runners: debootstrap bookworm/trixie for each arch.
+on: workflow_dispatch
+jobs:
+  placeholder:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "build pipeline not yet wired — see file header"
diff --git a/arch/distcc-avahi/PKGBUILD b/arch/distcc-avahi/PKGBUILD
new file mode 100644
index 000000000..88e266207
--- /dev/null
+++ b/arch/distcc-avahi/PKGBUILD
@@ -0,0 +1,70 @@
+# Maintainer: Markus Fritsche <mfritsche@reauktion.de>
+# Based on Arch Linux ARM's distcc PKGBUILD, rebuilt with --with-avahi
+# so Zeroconf-announced compile servers are discoverable on the LAN.
+#
+# Why this exists: the ALARM aarch64 distcc binary package is built
+# without --with-avahi, so the distccd --zeroconf flag is a no-op.
+# The Arch x86_64 package is fine. This package replaces distcc on
+# ALARM hosts with an avahi-aware build.
+
+pkgname=distcc-avahi
+_pkgname=distcc
+pkgver=3.4
+pkgrel=15
+pkgdesc="Distributed compilation service for C, C++ and Objective-C (with Avahi/Zeroconf support)"
+arch=('x86_64' 'aarch64')
+url="https://github.com/distcc/distcc"
+license=('GPL-2.0-only')
+depends=('popt' 'python' 'avahi')
+makedepends=('autoconf' 'automake' 'libtool' 'pkgconf' 'python-setuptools')
+optdepends=('gtk3: for distccmon')
+provides=("distcc=${pkgver}")
+conflicts=('distcc')
+replaces=('distcc')
+backup=('etc/conf.d/distccd')
+source=(
+    "https://github.com/distcc/distcc/releases/download/v${pkgver}/distcc-${pkgver}.tar.gz"
+    "distccd.conf"
+    "distccd.service"
+    "distcc.tmpfiles"
+)
+sha256sums=(
+    'SKIP'  # pin when first built in CI
+    'SKIP'
+    'SKIP'
+    'SKIP'
+)
+
+prepare() {
+    cd "${_pkgname}-${pkgver}"
+    autoreconf -fiv
+}
+
+build() {
+    cd "${_pkgname}-${pkgver}"
+    ./configure \
+        --prefix=/usr \
+        --sysconfdir=/etc \
+        --mandir=/usr/share/man \
+        --with-auth \
+        --with-avahi \
+        --without-libiberty \
+        --enable-rfc2553 \
+        --with-docdir="/usr/share/doc/${pkgname}"
+    make
+    make -C doc
+}
+
+check() {
+    cd "${_pkgname}-${pkgver}"
+    # Upstream test suite is flaky under makepkg; skip unless CHECK=1.
+    [ "${CHECK:-0}" = "1" ] && make check || true
+}
+
+package() {
+    cd "${_pkgname}-${pkgver}"
+    make DESTDIR="${pkgdir}" prefix=/usr install
+    install -Dm644 ../distccd.conf    "${pkgdir}/etc/conf.d/distccd"
+    install -Dm644 ../distccd.service "${pkgdir}/usr/lib/systemd/system/distccd.service"
+    install -Dm644 ../distcc.tmpfiles "${pkgdir}/usr/lib/tmpfiles.d/distcc.conf"
+}
diff --git a/arch/distcc-avahi/distcc.tmpfiles b/arch/distcc-avahi/distcc.tmpfiles
new file mode 100644
index 000000000..a0a7ec581
--- /dev/null
+++ b/arch/distcc-avahi/distcc.tmpfiles
@@ -0,0 +1 @@
+d /var/log/distcc 0755 nobody nobody -
diff --git a/arch/distcc-avahi/distccd.conf b/arch/distcc-avahi/distccd.conf
new file mode 100644
index 000000000..4e32d9ce9
--- /dev/null
+++ b/arch/distcc-avahi/distccd.conf
@@ -0,0 +1,5 @@
+# Configuration for distccd.service
+#
+# --allow lists are whitespace-separated CIDR blocks. At minimum,
+# allow our LAN and VPN:
+DISTCC_OPTS="--allow 192.168.88.0/24 --allow 10.170.16.0/24 --zeroconf --jobs 16 --nice 5 --log-level info --log-stderr"
diff --git a/arch/distcc-avahi/distccd.service b/arch/distcc-avahi/distccd.service
new file mode 100644
index 000000000..4f6dff1b1
--- /dev/null
+++ b/arch/distcc-avahi/distccd.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=distcc compile server (Zeroconf-announced)
+After=network-online.target avahi-daemon.service
+Wants=network-online.target avahi-daemon.service
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/conf.d/distccd
+User=nobody
+Group=nobody
+ExecStart=/usr/bin/distccd --no-detach --daemon $DISTCC_OPTS
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target