diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..b65ba4b
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,118 @@
+name: Build binaries
+
+on:
+  push:
+    branches: [master]
+    tags: ['v*']
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  # Measure before stripping; the packaged copy is stripped below.
+  CARGO_PROFILE_RELEASE_STRIP: none
+
+jobs:
+  build:
+    name: Build (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      TARGET: ${{ matrix.target }}
+    defaults:
+      run:
+        shell: bash
+    strategy:
+      fail-fast: false
+      # Supported by Gitea 28; bound concurrent cross-build memory use.
+      max-parallel: 2
+      matrix:
+        target:
+          - x86_64-musl
+          - i686-musl
+          - arm-musleabi
+          - arm-musleabihf
+          - armv7-musleabi
+          - armv7-musleabihf
+          - aarch64-musl
+          - mips-musl
+          - mipsel-musl
+          - mips64-muslabi64
+          - mips64el-muslabi64
+          - riscv64gc-musl
+    steps:
+      - name: Checkout
+        uses: builtin:checkout
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
+        with:
+          toolchain: ${{ startsWith(matrix.target, 'mips') && 'nightly' || 'stable' }}
+          cache: false
+
+      - name: Install cross and binary tools
+        env:
+          # Upstream cross warnings must not block installing the build tool.
+          CARGO_BUILD_WARNINGS: warn
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends binutils llvm
+          cargo install --git https://github.com/cross-rs/cross --locked cross
+          echo "RUST_TARGET=${TARGET%-*}-unknown-linux-${TARGET#*-}" >> "$GITHUB_ENV"
+
+      - name: Build release binary
+        env:
+          RUSTFLAGS: -C target-feature=+crt-static
+          # Copy toolchains and sources instead of translating nested bind mounts.
+          CROSS_REMOTE: "true"
+          CROSS_DEBUG: "true"
+        run: |
+          # Cross executes Cargo from this sysroot inside the build container.
+          sysroot=$(rustc --print sysroot)
+          printf 'Rust sysroot: %s\n' "$sysroot"
+          ls -l "$sysroot/bin/cargo"
+          "$sysroot/bin/cargo" --version
+          build_std=()
+          case "$TARGET" in
+            mips*) build_std=(-Z 'build-std=std,panic_abort') ;;
+          esac
+          cross build --release --locked --verbose --target "$RUST_TARGET" "${build_std[@]}"
+
+      - name: Verify, package, and summarize binary
+        run: |
+          binary="target/${RUST_TARGET}/release/sqm-autorate-rust"
+          readelf --program-headers "$binary" > /tmp/program-headers.txt
+          readelf --dynamic "$binary" > /tmp/dynamic-section.txt
+          if grep -q INTERP /tmp/program-headers.txt || grep -q NEEDED /tmp/dynamic-section.txt; then
+            echo "Binary is not statically linked" >&2
+            exit 1
+          fi
+          mkdir -p dist
+          stripped="dist/sqm-autorate-rust-${TARGET}"
+          artifact="${stripped}.tar.gz"
+          cp "$binary" "$stripped"
+          llvm-strip --strip-all "$stripped"
+          # Tar preserves executable permissions when downloading the artifact.
+          tar -czf "$artifact" -C dist "sqm-autorate-rust-${TARGET}"
+
+          size() {
+            stat -c %s "$1" | numfmt --to=iec-i --suffix=B --format='%.1f'
+          }
+          {
+            echo '| Target | Unstripped | Stripped | Compressed |'
+            echo '|:--|--:|--:|--:|'
+            printf '| %s | %s | %s | %s |\n' \
+              "$TARGET" "$(size "$binary")" "$(size "$stripped")" "$(size "$artifact")"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload binary
+        # Use the v3 artifact protocol supported by Gitea.
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: sqm-autorate-rust-${{ matrix.target }}
+          path: dist/sqm-autorate-rust-${{ matrix.target }}.tar.gz
+          if-no-files-found: error
diff --git a/.gitea/workflows/supply-chain.yml b/.gitea/workflows/supply-chain.yml
index 983ff59..4a38320 100644
--- a/.gitea/workflows/supply-chain.yml
+++ b/.gitea/workflows/supply-chain.yml
@@ -52,8 +52,11 @@ jobs:
       - name: Install actionlint
         run: go install "github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION}"
       - name: Check workflow syntax
+        # actionlint does not recognize Gitea's built-in checkout action.
         run: |
           "$(go env GOPATH)/bin/actionlint" \
+            -ignore 'specifying action "builtin:checkout" in invalid format' \
+            .gitea/workflows/build.yml \
             .gitea/workflows/ci.yml \
             .gitea/workflows/supply-chain.yml \
             .github/workflows/actions-security.yml \
diff --git a/Cross.toml b/Cross.toml
index e0a7a7d..9133b39 100644
--- a/Cross.toml
+++ b/Cross.toml
@@ -1,3 +1,10 @@
 [target.x86_64-unknown-freebsd]
 image.name = "ghcr.io/cross-rs/x86_64-unknown-freebsd:local"
 image.toolchain = ["linux/arm64=aarch64-unknown-linux-gnu"]
+
+[build]
+pre-build = ["apt-get update && apt-get install -y --no-install-recommends pkg-config"]
+
+# This target's image was added after the cross 0.2.5 release.
+[target.riscv64gc-unknown-linux-musl]
+image = "ghcr.io/cross-rs/riscv64gc-unknown-linux-musl:main"