diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8db022..8582247 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -199,6 +199,54 @@ jobs:
             "$GITEA_URL/api/v1/packages/inbuxa/container/inbuxa-admin/-/link/inbuxa-admin" \
             || echo "package already linked (or link refused); not fatal"
 
+  # The console's files for a host install (the installer's --console host),
+  # taken out of the image that was just published rather than built again:
+  # the tarball is what the image serves. They are static files, the same for
+  # every architecture, so one tarball. index.html carries no api-base-url;
+  # whoever installs it writes one, as the image's entrypoint does.
+  files:
+    if: ${{ vars.BUILD_ON == 'github' && github.ref_type == 'tag' }}
+    needs: [version, publish]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.version.outputs.version }}
+      TAG: ${{ github.ref_name }}
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+    steps:
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ${{ vars.REGISTRY }}
+          username: jcoffey-dev
+          password: ${{ secrets.GITEA_TOKEN }}
+      - name: take the files out of the image
+        run: |
+          set -euo pipefail
+          mkdir -p out
+          docker pull -q --platform linux/amd64 "$IMAGE:$VERSION"
+          id="$(docker create --platform linux/amd64 "$IMAGE:$VERSION")"
+          docker cp "$id:/usr/share/nginx/html" console
+          docker rm -f "$id" >/dev/null
+          tar --owner=0 --group=0 -czf out/inbuxa-admin.tar.gz -C console .
+          (cd out && sha256sum inbuxa-admin.tar.gz > SHA256SUMS && cat SHA256SUMS)
+      # A re-run replaces the assets rather than adding a second file of the
+      # same name. Uploads cross Cloudflare: HTTP/1.1, with retries, as the
+      # server's binaries do.
+      - name: attach them to the release
+        run: |
+          set -euo pipefail
+          api="$GITEA_URL/api/v1/repos/$GITHUB_REPOSITORY"
+          auth="Authorization: token $GITEA_TOKEN"
+          retry=(--retry 5 --retry-all-errors --retry-delay 15)
+          rel="$(curl -fsS "${retry[@]}" -H "$auth" "$api/releases/tags/$TAG" | jq -r .id)"
+          assets="$(curl -fsS "${retry[@]}" -H "$auth" "$api/releases/$rel/assets")"
+          for f in out/inbuxa-admin.tar.gz out/SHA256SUMS; do
+            name="$(basename "$f")"
+            old="$(jq -r --arg n "$name" '.[] | select(.name == $n) | .id' <<<"$assets")"
+            for id in $old; do curl -fsS "${retry[@]}" -o /dev/null -X DELETE -H "$auth" "$api/releases/$rel/assets/$id"; done
+            curl -fsS --http1.1 "${retry[@]}" -o /dev/null -X POST -H "$auth" -F "attachment=@$f" "$api/releases/$rel/assets?name=$name"
+            echo "attached $name"
+          done
+
   # ------------------------------------------------------ ghcr replica ------
   # Copies the release image from the Gitea registry, which stays the
   # authoritative one, to ghcr.io under the same version tag and :latest. It is
@@ -282,7 +330,7 @@ jobs:
   # for, and what a Gitea PR shows.
   report:
     if: ${{ always() && vars.BUILD_ON == 'github' }}
-    needs: [pending, build, version, image, publish]
+    needs: [pending, build, version, image, publish, files]
     runs-on: ubuntu-latest
     steps:
       - env: