diff --git a/.github/workflows/build-flatpak.yml b/.github/workflows/build-flatpak.yml
index a5c013a..5511f1a 100644
--- a/.github/workflows/build-flatpak.yml
+++ b/.github/workflows/build-flatpak.yml
@@ -2,7 +2,11 @@
 name: build-flatpak
 
 on:
-   workflow_call:
+  workflow_call:
+
+  push:
+    branches:
+      - flathub-release
 
 jobs:
   build-linux:
@@ -48,3 +52,14 @@ jobs:
         # skip step when running under act-cli
         if: |
           env.ACT != 'true'
+
+      - name: Deploy release to Flathub
+        uses: flatpak/flatpak-github-actions/flat-manager@v4
+        with:
+          repository: flathub
+          flat-manager-url: https://flathub.org
+          token: ${{ secrets.FLATHUB_TOKEN }}
+          verbose: true
+        # only execute step when pushing to "flathub-release" branch
+        if: |
+          github.ref == 'refs/heads/flathub-release'
diff --git a/.gitignore b/.gitignore
index b00d5d1..0144ce6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,6 +17,8 @@
 # flatpak bundle copied out from act-cli container for testing
 # flatpak --user install --bundle ./io.github.bkueng.qMasterPassword
 /io.github.bkueng.qMasterPassword
+/.event.json
+/.secrets
 
 *.log