diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..c8065f4
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,45 @@
+name: Build AD Bulk Tool
+
+on:
+  push:
+    branches: [main, feature/**, bugfix/**]
+  pull_request:
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        rid: [win-x64, linux-x64, osx-x64, osx-arm64]
+        include:
+          - rid: win-x64
+            os: ubuntu-latest
+            suffix: .exe
+          - rid: linux-x64
+            os: ubuntu-latest
+            suffix: ''
+          - rid: osx-x64
+            os: macos-latest
+            suffix: ''
+          - rid: osx-arm64
+            os: macos-latest
+            suffix: ''
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Publish (${{ matrix.rid }})
+        run: dotnet publish ADBulkTool.csproj -c Release -r ${{ matrix.rid }} --self-contained true -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -o publish/${{ matrix.rid }}
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ADBulkTool-${{ matrix.rid }}
+          path: publish/${{ matrix.rid }}/ADBulkTool${{ matrix.suffix }}
diff --git a/README.md b/README.md
index 82cd9b3..8419887 100644
--- a/README.md
+++ b/README.md
@@ -11,42 +11,34 @@ Cross-platform Avalonia UI app for bulk Active Directory operations from a CSV f
 - Actions: enable, disable, add/remove from group, set/force password change
 - LDAP 389 for normal edits; LDAPS 636 required for password resets
 
-## Prerequisites
+## Download
+
+Pre-built binaries for each platform (no .NET SDK required):
+
+| Platform | File |
+|----------|------|
+| Windows x64 | `ADBulkTool-win-x64.exe` |
+| Linux x64 | `ADBulkTool-linux-x64` |
+| macOS x64 | `ADBulkTool-macos-x64` |
+| macOS ARM | `ADBulkTool-macos-arm64` |
+
+Grab the latest from [Releases](https://gitea.mikisoq.cc/mikisoq/ADBulk/releases/latest).
+
+## Build from source
+
+### Prerequisites
 
 - [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
 
-### Windows
+| Platform | Install |
+|----------|---------|
+| Windows | `winget install Microsoft.DotNet.SDK.8` |
+| Arch-based | `sudo pacman -S dotnet-sdk-8.0` |
+| Ubuntu / Debian | Register Microsoft repo then `sudo apt install dotnet-sdk-8.0` |
+| Fedora / RHEL | `sudo dnf install dotnet-sdk-8.0` |
+| macOS | `brew install dotnet-sdk-8.0` |
 
-```powershell
-winget install Microsoft.DotNet.SDK.8
-```
-
-### Linux (Arch-based)
-
-```bash
-sudo pacman -S dotnet-sdk-8.0
-```
-
-### Linux (Ubuntu / Debian)
-
-```bash
-# Register Microsoft repository, then:
-sudo apt install dotnet-sdk-8.0
-```
-
-### Linux (Fedora / RHEL)
-
-```bash
-sudo dnf install dotnet-sdk-8.0
-```
-
-### macOS
-
-```bash
-brew install dotnet-sdk-8.0
-```
-
-## Install & Run
+### Run directly
 
 ```bash
 git clone https://gitea.mikisoq.cc/mikisoq/ADBulk.git
@@ -56,7 +48,20 @@ dotnet build
 dotnet run
 ```
 
-On Windows, you can also open the folder in Visual Studio and run from there.
+### Build standalone executables
+
+```bash
+# All platforms at once (Linux/macOS)
+./scripts/publish-all.sh
+
+# All platforms at once (Windows PowerShell)
+.\scripts\publish-all.ps1
+
+# Single platform
+dotnet publish -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true
+```
+
+Output goes to `publish/` — a single .exe/binary per platform, no runtime needed.
 
 ## Quick start
 
diff --git a/scripts/publish-all.ps1 b/scripts/publish-all.ps1
new file mode 100644
index 0000000..e860fb3
--- /dev/null
+++ b/scripts/publish-all.ps1
@@ -0,0 +1,35 @@
+param(
+    [string]$Version = "1.0.0"
+)
+
+$Project = "ADBulkTool.csproj"
+$Config = "Release"
+
+function Publish {
+    param([string]$Rid, [string]$Suffix)
+
+    Write-Host "Publishing for $Rid..."
+    dotnet publish $Project `
+        -c $Config `
+        -r $Rid `
+        --self-contained true `
+        -p:PublishSingleFile=true `
+        -p:IncludeNativeLibrariesForSelfExtract=true `
+        -p:Version=$Version `
+        -o "publish/$Suffix"
+
+    Write-Host "  -> publish/$Suffix"
+}
+
+Push-Location (Split-Path $PSScriptRoot)
+
+Publish "win-x64"   "windows-x64"
+Publish "linux-x64" "linux-x64"
+Publish "osx-x64"   "macos-x64"
+Publish "osx-arm64" "macos-arm64"
+
+Write-Host ""
+Write-Host "All builds complete. Artifacts are in ./publish/"
+Get-ChildItem ./publish/*/ | Select-Object Name, Length
+
+Pop-Location
diff --git a/scripts/publish-all.sh b/scripts/publish-all.sh
new file mode 100755
index 0000000..53d6118
--- /dev/null
+++ b/scripts/publish-all.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+PROJECT="ADBulkTool.csproj"
+CONFIG="Release"
+VERSION="${1:-1.0.0}"
+
+publish() {
+    local rid="$1"
+    local suffix="$2"
+    echo "Publishing for $rid..."
+    dotnet publish "$PROJECT" \
+        -c "$CONFIG" \
+        -r "$rid" \
+        --self-contained true \
+        -p:PublishSingleFile=true \
+        -p:IncludeNativeLibrariesForSelfExtract=true \
+        -p:Version="$VERSION" \
+        -o "publish/$suffix"
+    echo "  -> publish/$suffix"
+}
+
+publish "win-x64"   "windows-x64"
+publish "linux-x64" "linux-x64"
+publish "osx-x64"   "macos-x64"
+publish "osx-arm64" "macos-arm64"
+
+echo ""
+echo "All builds complete. Artifacts are in ./publish/"
+ls -lh publish/*/