diff --git a/README.md b/README.md
index 6fbc5ad..02e4855 100644
--- a/README.md
+++ b/README.md
@@ -188,21 +188,19 @@ sidecar for its target OS.
 
 ## Publish a GitHub Release
 
-The current publisher still uses the legacy Linux tarball. It will be switched
-to the portable artifacts after they have been manually checked:
-
 ```bash
 ./scripts/publish-github-release.sh v0.1.0-alpha.1
 ```
 
 The command requires an authenticated [`gh`](https://cli.github.com/) CLI, a
 clean local `main` equal to `origin/main`, and the sibling official-plugins
-checkout. It runs the local release script, creates an annotated Git tag when
-needed, pushes that tag through `origin`, then creates or updates the GitHub
-Release with the archive and `SHA256SUMS`. In this checkout `origin` also
-pushes the tag to the configured mirror; other maintainers can add a second
-push URL if they use a mirror too. Publish the compatible official-plugins
-release before publishing the desktop archive that embeds those plugins.
+checkout. It builds the Debian package, Linux AppImage and Windows portable
+ZIP, then creates or updates the GitHub Release with those three artifacts and
+`SHA256SUMS`. Alpha, beta and release-candidate tags are marked as GitHub
+prereleases; stable tags are marked latest. The command creates an annotated
+tag when needed and pushes it through `origin`, which also mirrors tags in this
+checkout. Publish the compatible official-plugins release before the desktop
+release that embeds those plugins.
 
 ## License
 
diff --git a/scripts/publish-github-release.sh b/scripts/publish-github-release.sh
index eea7a92..333bf84 100755
--- a/scripts/publish-github-release.sh
+++ b/scripts/publish-github-release.sh
@@ -39,15 +39,18 @@ fi
 
 "$RELEASE_SCRIPT" "$VERSION"
 
-shopt -s nullglob
-ASSETS=("$RELEASE_DIR"/*.tar.gz "$RELEASE_DIR"/*.tgz)
-if [[ -f "$RELEASE_DIR/SHA256SUMS" ]]; then
-  ASSETS+=("$RELEASE_DIR/SHA256SUMS")
-fi
-if [[ ${#ASSETS[@]} -eq 0 ]]; then
-  echo "no release assets found in $RELEASE_DIR" >&2
-  exit 1
-fi
+ASSETS=(
+  "$RELEASE_DIR/verstak_${VERSION#v}_amd64.deb"
+  "$RELEASE_DIR/verstak-linux-x86_64-$VERSION.AppImage"
+  "$RELEASE_DIR/verstak-windows-amd64-$VERSION.zip"
+  "$RELEASE_DIR/SHA256SUMS"
+)
+for asset in "${ASSETS[@]}"; do
+  if [[ ! -s "$asset" ]]; then
+    echo "required release asset is missing or empty: $asset" >&2
+    exit 1
+  fi
+done
 
 if "$GIT_BIN" rev-parse -q --verify "refs/tags/$VERSION" >/dev/null; then
   if [[ "$("$GIT_BIN" rev-parse "${VERSION}^{commit}")" != "$HEAD" ]]; then
@@ -62,12 +65,16 @@ fi
 if "$GH_BIN" release view "$VERSION" --repo "$REPOSITORY" >/dev/null 2>&1; then
   "$GH_BIN" release upload "$VERSION" "${ASSETS[@]}" --repo "$REPOSITORY" --clobber
 else
+  RELEASE_OPTIONS=(--generate-notes --verify-tag)
+  if [[ "$VERSION" == *-* ]]; then
+    RELEASE_OPTIONS+=(--prerelease)
+  else
+    RELEASE_OPTIONS+=(--latest)
+  fi
   "$GH_BIN" release create "$VERSION" "${ASSETS[@]}" \
     --repo "$REPOSITORY" \
     --title "Verstak $VERSION" \
-    --generate-notes \
-    --latest \
-    --verify-tag
+    "${RELEASE_OPTIONS[@]}"
 fi
 
 echo "GitHub release:"
diff --git a/scripts/release.sh b/scripts/release.sh
index 2995bc7..55c5b39 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -10,40 +10,17 @@ if [[ -z "$VERSION" || ! "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
   exit 2
 fi
 
-if ! command -v pkg-config >/dev/null || \
-  (! pkg-config --exists webkit2gtk-4.1 && ! pkg-config --exists webkit2gtk-4.0); then
-  echo "Linux desktop releases require libwebkit2gtk-4.1-dev or libwebkit2gtk-4.0-dev." >&2
-  exit 1
-fi
-
-OFFICIAL_PLUGINS="${VERSTAK_OFFICIAL_PLUGINS_DIR:-$ROOT/../verstak-official-plugins}"
-if [[ ! -d "$OFFICIAL_PLUGINS" ]]; then
-  echo "official plugins repository not found: $OFFICIAL_PLUGINS" >&2
-  exit 1
-fi
-
 echo "=== verstak desktop release $VERSION ==="
-(cd "$OFFICIAL_PLUGINS" && ./scripts/build.sh)
-"$ROOT/scripts/install-dev-plugins.sh"
-"$ROOT/scripts/build.sh"
-
-BINARY="$(find "$ROOT/build/bin" -maxdepth 1 -type f -name 'verstak-desktop*' -print -quit)"
-if [[ -z "$BINARY" ]]; then
-  echo "desktop binary was not produced in build/bin" >&2
-  exit 1
-fi
-
 RELEASE_ROOT="$ROOT/release"
-STAGING="$RELEASE_ROOT/verstak-desktop-$VERSION-linux-amd64"
-ARCHIVE="$RELEASE_ROOT/verstak-desktop-linux-amd64-$VERSION.tar.gz"
-rm -rf "$STAGING" "$ARCHIVE"
-mkdir -p "$STAGING"
+rm -rf "$RELEASE_ROOT"
+mkdir -p "$RELEASE_ROOT"
 
-cp "$BINARY" "$STAGING/verstak-desktop"
-cp "$ROOT/README.md" "$ROOT/LICENSE" "$STAGING/"
-cp -R "$ROOT/plugins" "$STAGING/plugins"
-tar -C "$RELEASE_ROOT" -czf "$ARCHIVE" "$(basename "$STAGING")"
-(cd "$RELEASE_ROOT" && sha256sum "$(basename "$ARCHIVE")" > SHA256SUMS)
+"$ROOT/scripts/package-deb.sh" "$VERSION"
+"$ROOT/scripts/package-appimage.sh" "$VERSION"
+"$ROOT/scripts/package-windows-portable.sh" "$VERSION"
 
-echo "release archive: $ARCHIVE"
-echo "checksums:       $RELEASE_ROOT/SHA256SUMS"
+(cd "$RELEASE_ROOT" && find . -maxdepth 1 -type f \( -name '*.deb' -o -name '*.AppImage' -o -name '*.zip' \) \
+  -printf '%f\n' | LC_ALL=C sort | xargs -r sha256sum > SHA256SUMS)
+
+echo "release assets: $RELEASE_ROOT"
+echo "checksums:      $RELEASE_ROOT/SHA256SUMS"
diff --git a/scripts/test-package-formats.sh b/scripts/test-package-formats.sh
index f06104a..94de09f 100755
--- a/scripts/test-package-formats.sh
+++ b/scripts/test-package-formats.sh
@@ -33,6 +33,9 @@ fi
 grep -Fq 'zip -qr' "$ROOT/scripts/package-windows-portable.sh"
 grep -Fq 'LinkId=2124701' "$ROOT/README.md"
 grep -Fq 'WebView2 Runtime' "$ROOT/README.md"
+grep -Fq 'package-deb.sh' "$ROOT/scripts/release.sh"
+grep -Fq 'package-appimage.sh' "$ROOT/scripts/release.sh"
+grep -Fq 'package-windows-portable.sh' "$ROOT/scripts/release.sh"
 grep -Fq 'chmod -R a+rX' "$ROOT/scripts/build-linux-bundle.sh"
 
 echo "desktop package script contracts passed"
diff --git a/scripts/test-publish-github-release.sh b/scripts/test-publish-github-release.sh
index 29800dc..30cc596 100755
--- a/scripts/test-publish-github-release.sh
+++ b/scripts/test-publish-github-release.sh
@@ -5,7 +5,11 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 PUBLISHER="$ROOT/scripts/publish-github-release.sh"
 VERSION="v0.0.0-test"
 REPOSITORY="mirivlad/verstak"
-ASSET_NAME="verstak-desktop-linux-amd64-${VERSION}.tar.gz"
+ASSET_NAMES=(
+  "verstak_0.0.0-test_amd64.deb"
+  "verstak-linux-x86_64-v0.0.0-test.AppImage"
+  "verstak-windows-amd64-v0.0.0-test.zip"
+)
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 
@@ -22,7 +26,9 @@ cat > "$WORK/release.sh" <<'SCRIPT'
 #!/usr/bin/env bash
 set -euo pipefail
 printf 'release:%s\n' "$1" >> "$LOG"
-printf 'archive\n' > "$VERSTAK_RELEASE_DIR/verstak-desktop-linux-amd64-$1.tar.gz"
+printf 'deb\n' > "$VERSTAK_RELEASE_DIR/verstak_${1#v}_amd64.deb"
+printf 'appimage\n' > "$VERSTAK_RELEASE_DIR/verstak-linux-x86_64-$1.AppImage"
+printf 'zip\n' > "$VERSTAK_RELEASE_DIR/verstak-windows-amd64-$1.zip"
 printf 'checksum\n' > "$VERSTAK_RELEASE_DIR/SHA256SUMS"
 SCRIPT
 chmod +x "$WORK/release.sh"
@@ -82,8 +88,11 @@ grep -Fqx "release:$VERSION" "$LOG"
 grep -Fqx "tag:$VERSION" "$LOG"
 grep -Fqx "push:origin:refs/tags/$VERSION" "$LOG"
 grep -F "release create $VERSION" "$LOG" >/dev/null
-grep -F "$ASSET_NAME" "$LOG" >/dev/null
+for asset in "${ASSET_NAMES[@]}"; do
+  grep -F "$asset" "$LOG" >/dev/null
+done
 grep -F "SHA256SUMS" "$LOG" >/dev/null
+grep -F -- "--prerelease" "$LOG" >/dev/null
 
 run_publisher
 grep -F "release upload $VERSION" "$LOG" >/dev/null