diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c6585b9..469acad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,11 +3,13 @@
 
 name: Release tarball
 
-# Builds the install tarball (pure PHP app, no runtime dependencies, no build
-# step) and, when a release is published, attaches it as a release asset.
-# workflow_dispatch produces a downloadable artifact for testing without
-# publishing a release. No secrets, no App Store upload: the store later only
-# receives the download URL and a signature.
+# Builds the install tarball with ncmake and, when a release is published,
+# attaches it as a release asset. workflow_dispatch produces a downloadable
+# artifact for testing without publishing a release. The shipped file set comes
+# entirely from ncmake (keep model + .nextcloudignore) — this workflow carries
+# no file list of its own and is identical across all ncmake apps. No secrets,
+# no App Store upload: the store later only receives the download URL and a
+# signature.
 
 on:
   release:
@@ -26,23 +28,17 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Assemble runtime tree
-        run: |
-          mkdir -p package/admin_audit_http_client
-          cp -r appinfo lib LICENSES CHANGELOG.md REUSE.toml package/admin_audit_http_client/
+      - name: Build the release tarball
+        run: make build && make dist
 
-      - name: Create tarball
-        run: |
-          version=$(grep -oPm1 '(?<=<version>)[^<]+' appinfo/info.xml)
-          tarball="admin_audit_http_client-${version}.tar.gz"
-          tar -C package -czf "$tarball" admin_audit_http_client
-          echo "TARBALL=$tarball" >> "$GITHUB_ENV"
+      - name: Locate the tarball
+        run: echo "TARBALL=$(ls build/artifacts/dist/*.tar.gz)" >> "$GITHUB_ENV"
 
       - name: Upload build artifact
         uses: actions/upload-artifact@v7
         with:
-          name: admin_audit_http_client-tarball
-          path: ${{ env.TARBALL }}
+          name: release-tarball
+          path: build/artifacts/dist/*.tar.gz
 
       - name: Attach to release
         if: github.event_name == 'release'
diff --git a/.nextcloudignore b/.nextcloudignore
new file mode 100644
index 0000000..57872d0
--- /dev/null
+++ b/.nextcloudignore
@@ -0,0 +1 @@
+/vendor/
diff --git a/REUSE.toml b/REUSE.toml
index f191ce2..783b894 100644
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -12,7 +12,7 @@ SPDX-FileCopyrightText = "2026 [ernolf] Raphael Gradenwitz"
 SPDX-License-Identifier = "AGPL-3.0-or-later"
 
 [[annotations]]
-path = [".github/FUNDING.yml"]
+path = [".github/FUNDING.yml", ".nextcloudignore"]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "2026 [ernolf] Raphael Gradenwitz"
 SPDX-License-Identifier = "AGPL-3.0-or-later"