diff --git a/galaxy.yml b/galaxy.yml
index 03c75b9..b0d5cab 100644
--- a/galaxy.yml
+++ b/galaxy.yml
@@ -1,70 +1,59 @@
-### REQUIRED
-# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
-# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
-# underscores or numbers and cannot contain consecutive underscores
-namespace: kewlfft
+name: Build and Publish Collection to Ansible Galaxy
 
-# The name of the collection. Has the same character restrictions as 'namespace'
-name: aur
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
 
-# The version of the collection. Must be compatible with semantic versioning
-version: 0.12.2
+defaults:
+  run:
+    working-directory: collections/ansible_collections/kewlfft/aur
 
-# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
-readme: README.md
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+        with:
+          path: collections/ansible_collections/kewlfft/aur
 
-# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
-# @nicks:irc/im.site#channel'
-authors:
-- kewl fft <kewl@alto.eu.org>
+      - name: Debug workflow version
+        run: echo "=== RUNNING UPDATED WORKFLOW ==="
 
+      - name: Verify version in galaxy.yml matches release tag
+        run: |
+          tag_version="${GITHUB_REF##*/}"   # e.g., v0.12.2
+          tag_version="${tag_version#v}"    # strip leading 'v' if present
+          file_version=$(awk '/^version:/ {print $2}' galaxy.yml)
 
-### OPTIONAL but strongly recommended
-# A short summary description of the collection
-description: This collection includes an Ansible module to manage packages from the AUR.
+          if [ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ] && [ "$file_version" != "$tag_version" ]; then
+              echo "❌ galaxy.yml version ($file_version) does not match tag ($tag_version)"
+              exit 1
+          fi
+          echo "✅ Version check passed: $file_version"
 
-# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
-# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
-license:
-- GPL-3.0-or-later
+      - name: Build collection
+        run: |
+          path=$(ansible-galaxy collection build | awk '/Created collection/ {print $NF}')
+          echo "TARBALL=$path" >> $GITHUB_ENV
+          echo "📦 Built collection at $path"
 
-# The path to the license file for the collection. This path is relative to the root of the collection. This key is
-# mutually exclusive with 'license'
-license_file: ''
+      - name: Upload built collection artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ansible-collection-tarball
+          path: ${{ env.TARBALL }}
 
-# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
-# requirements as 'namespace' and 'name'
-tags:
-  - aur
-  - arch_user_repository
-  - arch
-  - archlinux
-  - arch_linux
-  - packaging
-  - software
+      - name: Debug tarball before publish
+        run: |
+          echo "🔎 Checking tarball path..."
+          echo "TARBALL=$TARBALL"
+          ls -l "$(dirname "$TARBALL")"
 
-# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
-# collection label 'namespace.name'. The value is a version range
-# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
-# range specifiers can be set and are separated by ','
-dependencies: {}
-
-# The URL of the originating SCM repository
-repository: https://github.com/kewlfft/ansible-aur
-
-# The URL to any online docs
-documentation: https://github.com/kewlfft/ansible-aur/blob/master/README.md
-
-# The URL to the homepage of the collection/project
-homepage: https://github.com/kewlfft/ansible-aur
-
-# The URL to the collection issue tracker
-issues: https://github.com/kewlfft/ansible-aur/issues
-
-# A list of file glob-like patterns used to filter any files or directories that should not be included in the build
-# artifact. A pattern is matched from the relative path of the file or directory of the collection directory. This
-# uses 'fnmatch' to match the files or directories. Some directories and files like 'galaxy.yml', '*.pyc', '*.retry',
-# and '.git' are always filtered
-build_ignore:
-  - .github
-  - .gitignore
+      - name: Publish collection
+        if: github.event_name != 'workflow_dispatch'  # skip publish for manual testing
+        run: |
+          echo "📤 Publishing $TARBALL ..."
+          ansible-galaxy collection publish "$TARBALL" \
+            --api-key "${{ secrets.ANSIBLE_GALAXY_API_KEY }}"