diff --git a/.autoupdate b/.autoupdate
new file mode 100644
index 0000000..fef9f66
--- /dev/null
+++ b/.autoupdate
@@ -0,0 +1,6 @@
+# Autoupdater manifest - consumed by aur/.autoupdate
+srchost="gitea"
+srcmntr="source"
+srcname="skeptical-updater"
+verstrip=""
+gui="false"
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..214af94
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,6 @@
+# downloaded tarballs
+*.tar.gz
+# built packages
+*.rpm
+# rpmbuild tree
+rpmbuild/
diff --git a/README.md b/README.md
index 1b25ee5..2a808a5 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,15 @@
+# skeptical-updater
 RPM spec file for `skeptical-updater` package
+
+## Build
+
+`Version` is a placeholder until CI bumps it to the first upstream tag: to build
+by hand, set it to an existing tag first. Needs `rpm-build` and `rpmdevtools`
+(`spectool`; it is `rpmdev-spectool` on openSUSE).
+
+```sh
+mkdir -p rpmbuild/SOURCES
+spectool -g -C rpmbuild/SOURCES skeptical-updater.spec
+rpmbuild -bb --define "_topdir $PWD/rpmbuild" skeptical-updater.spec
+# -> rpmbuild/RPMS/noarch/skeptical-updater-<version>-1*.noarch.rpm
+```
diff --git a/skeptical-updater.spec b/skeptical-updater.spec
new file mode 100644
index 0000000..359708b
--- /dev/null
+++ b/skeptical-updater.spec
@@ -0,0 +1,45 @@
+Name:           skeptical-updater
+Version:        0.0.1
+Release:        1%{?dist}
+Summary:        A manual, conscious update cycle for apt, dnf/yum, pacman/pman and zypper
+
+License:        GPL-2.0-or-later
+URL:            https://git.bjphoster.com/source/%{name}
+Source0:        %{url}/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz
+
+BuildArch:      noarch
+
+Requires:       bash
+Recommends:     sudo
+
+%description
+skeptical-updater is a distribution-agnostic, single-file bash applet for a
+manual, conscious update cycle. It wraps the native package manager (apt,
+dnf/yum, pacman/pman, zypper), lists the packages that can be upgraded, lets
+the user interrogate each one, and only then runs the native upgrade. Packages
+the user has explicitly acknowledged are remembered in a state file and never
+questioned again.
+
+%prep
+%autosetup -n %{name}
+# run the system bash, not the first one in PATH (rpmlint env-script-interpreter)
+sed -i '1s|^#!/usr/bin/env bash$|#!/bin/bash|' %{name}
+
+%build
+# nothing to build: a single bash script
+
+%install
+install -Dm755 %{name} %{buildroot}%{_bindir}/%{name}
+
+%check
+# the tarball must be the version this spec claims
+test "$(bash ./%{name} --version)" = "%{name} %{version}"
+
+%files
+%license LICENSE
+%doc README.md docs/DESIGN.md
+%{_bindir}/%{name}
+
+%changelog
+* Sat Oct 10 2026 Bryan Joshua Pedini <bryan@pedini.dev> - 0.0.1-1
+- Initial placeholder; bumped by CI to the first upstream tag