diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 31e4b712..71720cad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -91,9 +91,8 @@ jobs:
     uses: ./.github/workflows/test.yml
     secrets: inherit
     permissions:
-      "contents": "read"
+      "contents": "write"
       "id-token": "write"
-      "pages": "write"
 
   # Build and packages all the platform-specific things
   build-local-artifacts:
@@ -325,16 +324,31 @@ jobs:
       "id-token": "write"
       "packages": "write"
 
+  custom-apt:
+    needs:
+      - plan
+      - host
+    if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
+    uses: ./.github/workflows/apt.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit
+    # publish jobs get escalated permissions
+    permissions:
+      "contents": "write"
+      "id-token": "write"
+
   announce:
     needs:
       - plan
       - host
       - custom-publish
       - custom-winget
+      - custom-apt
     # use "always() && ..." to allow us to wait for all publish jobs while
     # still allowing individual publish jobs to skip themselves (for prereleases).
     # "host" however must run to completion, no skipping allowed!
-    if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish.result == 'skipped' || needs.custom-publish.result == 'success') && (needs.custom-winget.result == 'skipped' || needs.custom-winget.result == 'success') }}
+    if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish.result == 'skipped' || needs.custom-publish.result == 'success') && (needs.custom-winget.result == 'skipped' || needs.custom-winget.result == 'success') && (needs.custom-apt.result == 'skipped' || needs.custom-apt.result == 'success') }}
     runs-on: "ubuntu-22.04"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6092adc7..dfd30cdf 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -93,6 +93,8 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - *linux-deps
       - *checkout
@@ -120,26 +122,14 @@ jobs:
           status: ${{ env.COVERAGE_PERCENT }}
           color: 'blue'
           path: 'target/llvm-cov/html/coverage.svg'
-      - name: "Upload default branch results to gh pages"
+      - name: "Deploy coverage to gh-pages under /coverage"
         if: *if-master
-        uses: actions/upload-pages-artifact@v5
+        uses: peaceiris/actions-gh-pages@v4
         with:
-          path: target/llvm-cov/html
-
-  deploy-coverage-page:
-    if: *if-master
-    needs: coverage
-    runs-on: ubuntu-latest
-    permissions:
-      pages: write
-      id-token: write
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - name: "Deploy gh pages"
-        id: deployment
-        uses: actions/deploy-pages@v5
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: target/llvm-cov/html
+          destination_dir: coverage
+          keep_files: true
 
   clippy:
     runs-on: ${{matrix.runner}}
@@ -269,7 +259,6 @@ jobs:
     needs:
       - nextest
       - coverage
-      - deploy-coverage-page
       - clippy
       - rustfmt
       - clippy-no-default-features
@@ -284,4 +273,4 @@ jobs:
             echo "One or more required jobs failed or were cancelled."
             exit 1
           fi
-          echo "All required jobs passed (deploy-coverage-page is expected to skip off master)."
+          echo "All required jobs passed."
diff --git a/README.md b/README.md
index da6447ce..fedd27f9 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
     <img src="https://github.com/skim-rs/skim/actions/workflows/test.yml/badge.svg?event=push" alt="Build & Test" />
   </a>
   <a href="https://skim-rs.github.io/skim" >
-    <img src="https://skim-rs.github.io/skim/coverage.svg" alt="coverage badge" />
+    <img src="https://skim-rs.github.io/skim/coverage/coverage.svg" alt="coverage badge" />
   </a>
   <a href="https://repology.org/project/skim-fuzzy-finder/versions">
     <img src="https://repology.org/badge/tiny-repos/skim-fuzzy-finder.svg" alt="Packaging status" />
@@ -101,6 +101,7 @@ The skim project contains several components:
 </a>
 
 ### Fedora
+
 Up to date Fedora packages are provided via an unofficial community-maintained COPR repository.
 ```bash
 sudo dnf copr enable sisyphus1813/skim
@@ -108,6 +109,7 @@ sudo dnf install skim
 ```
 
 ### Windows
+
 Using [winget](https://learn.microsoft.com/windows/package-manager/):
 ```powershell
 winget install skim
@@ -118,6 +120,7 @@ scoop install skim
 ```
 
 ### Debian and RPM packages
+
 Every [release](https://github.com/skim-rs/skim/releases/latest) ships prebuilt
 `.deb` and `.rpm` packages for `amd64` and `arm64`. Each one installs the `sk`
 executable, its man page and the bash/zsh/fish completions.
@@ -132,6 +135,23 @@ sudo dpkg -i skim_*_amd64.deb
 sudo rpm -i skim-*.x86_64.rpm
 ```
 
+### APT repository (Debian/Ubuntu)
+
+Instead of downloading a `.deb` manually, add the hosted APT repository to get
+`sk` from `apt` and receive updates:
+```sh
+# Import the signing key
+sudo mkdir -p /etc/apt/keyrings
+sudo wget -O /etc/apt/keyrings/skim.asc https://skim-rs.github.io/skim/apt/skim-archive-keyring.asc
+# ...or with curl:
+# curl -fsSL https://skim-rs.github.io/skim/apt/skim-archive-keyring.asc | sudo tee /etc/apt/keyrings/skim.asc > /dev/null
+
+# Add the repository
+echo 'deb [signed-by=/etc/apt/keyrings/skim.asc] https://skim-rs.github.io/skim/apt ./' | sudo tee /etc/apt/sources.list.d/skim.list
+sudo apt-get update
+sudo apt-get install skim
+```
+
 
 ## Manually
 
diff --git a/dist-workspace.toml b/dist-workspace.toml
index 5fac99a4..414aceaa 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -22,11 +22,14 @@ plan-jobs = ["./test"]
 # Global artifacts jobs to run in CI
 global-artifacts-jobs = ["./package"]
 # Publish jobs to run in CI
-publish-jobs = ["./publish", "./winget"]
+publish-jobs = ["./publish", "./winget", "./apt"]
 # Whether to publish prereleases to package managers
 publish-prereleases = true
 
 [dist.github-custom-job-permissions.test]
-contents = "read"
-pages = "write"
+contents = "write"
+id-token = "write"
+
+[dist.github-custom-job-permissions.apt]
+contents = "write"
 id-token = "write"