diff --git a/.drone.yml b/.drone.yml
index 1d4338973e..d8b440b99c 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -15,10 +15,7 @@ steps:
   commands:
     - apk add --update --no-cache git openssh
     - mkdir -p ~/.ssh
-    - |
-      cat <<EOF > ~/.ssh/id_rsa.pub
-      $SSH_PUBKEY
-      EOF
+    - echo $SSH_PUBKEY > ~/.ssh/id_rsa.pub
     - |
       cat <<EOF > ~/.ssh/id_rsa
       $SSH_PRIVKEY
@@ -60,7 +57,7 @@ steps:
     event:
       - tag
 
-- name: run-tests
+- name: tests
   image: python:3.11-alpine
   commands:
     - apk add --update --no-cache redis
@@ -71,6 +68,96 @@ steps:
     - apk del build-base g++ rust
     - pytest tests
 
+- name: update-arch-packages
+  image: python:3.11-alpine
+  environment:
+    WORKDIR: /tmp/workdir
+    SSH_PUBKEY:
+      from_secret: ssh_pubkey
+    SSH_PRIVKEY:
+      from_secret: ssh_privkey
+
+  when:
+    branch:
+      - master
+
+  depends_on:
+    - tests
+
+  commands:
+    - echo "-- Installing dependencies"
+    - apk add --update --no-cache curl git openssh pacman sudo
+
+    - echo "--- Parsing metadata"
+    - git config --global --add safe.directory $PWD
+    - export VERSION=$(python setup.py --version)
+    - export HEAD=$(git log | head -1 | awk '{printf "%.8s", $2}')
+    - export GIT_VERSION="$VERSION.r$(git log --pretty=oneline HEAD...$(git tag | tail -1) | wc -l).$HEAD"
+    - export TAG_URL="https://git.platypush.tech/platypush/platypush/archive/v$VERSION.tar.gz"
+    - export TAG_ARCHIVE="platypush-$VERSION.tar.gz"
+    - export CHECKSUM=$(curl --silent https://git.platypush.tech/platypush/platypush/archive/master.tar.gz | sha512sum | awk '{print $1}')
+
+    - echo "--- Preparing environment"
+    - mkdir -p ~/.ssh
+    - echo $SSH_PUBKEY > ~/.ssh/id_rsa.pub
+    - |
+      cat <<EOF > ~/.ssh/id_rsa
+      $SSH_PRIVKEY
+      EOF
+    - chmod 0600 ~/.ssh/id_rsa
+    - ssh-keyscan git.platypush.tech >> ~/.ssh/known_hosts 2>/dev/null
+    - ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
+    - adduser -u 1000 -D build
+    - mkdir -p $WORKDIR
+
+    - echo "--- Updating Arch git version"
+    - export PKGDIR=$WORKDIR/git
+    - git clone ssh://aur@aur.archlinux.org/platypush-git.git $PKGDIR
+    - git config --global --add safe.directory $PKGDIR
+    - chown -R build $PKGDIR
+    - cd $PKGDIR
+    - |
+      sed -i 'PKGBUILD' -r \
+        -e "s/^pkgver=.*/pkgver=$GIT_VERSION/" \
+        -e "s/^pkgrel=.*/pkgrel=1/" \
+        -e "s/^sha512sums=.*/sha512sums=('$CHECKSUM')/"
+    - sudo -u build makepkg --printsrcinfo > .SRCINFO
+    - export FILES_CHANGED=$(git status --porcelain --untracked-files=no | wc -l)
+    - |
+      if [ $FILES_CHANGED -gt 0 ]; then
+        echo "--- Pushing git package version $GIT_VERSION"
+        git commit -a -m '[Automatic] Package update'
+        git push origin master
+      fi
+
+    - echo "--- Updating Arch stable version"
+    - export PKGDIR=$WORKDIR/stable
+    - git clone ssh://aur@aur.archlinux.org/platypush.git $PKGDIR
+    - git config --global --add safe.directory $PKGDIR
+    - chown -R build $PKGDIR
+    - cd $PKGDIR
+    - export RELEASED_VERSION=$(grep -e '^pkgver=' PKGBUILD | sed -r -e 's/^pkgver=(.*)\s*/\1/')
+    - |
+      if [ "$RELEASED_VERSION" == "$VERSION" ]; then
+        exit 0
+      fi
+
+    - export TAG_CHECKSUM=$(curl --silent "$TAG_URL" | sha512sum | awk '{print $1}')
+    - |
+      sed -i 'PKGBUILD' -r \
+        -e "s/^pkgver=.*/pkgver=$VERSION/" \
+        -e "s/^pkgrel=.*/pkgrel=1/" \
+        -e "s/^sha512sums=.*/sha512sums=('$TAG_CHECKSUM')/"
+
+    - sudo -u build makepkg --printsrcinfo > .SRCINFO
+    - export FILES_CHANGED=$(git status --porcelain --untracked-files=no | wc -l)
+    - |
+      if [ $FILES_CHANGED -gt 0 ]; then
+        echo "--- Pushing stable package version $VERSION"
+        git commit -a -m '[Automatic] Package update'
+        git push origin master
+      fi
+
 volumes:
   - name: docs
     host: