diff --git a/packaging/PKGBUILD b/packaging/PKGBUILD
new file mode 100644
index 0000000..829277e
--- /dev/null
+++ b/packaging/PKGBUILD
@@ -0,0 +1,40 @@
+# Maintainer: Amir Husayn Panahifar <ahp@panahifar.ir>
+pkgname=prx
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="Safe proxy routing manager that keeps inbound connections (e.g. SSH) alive"
+arch=('x86_64' 'aarch64')
+url="https://github.com/example/prx"
+license=('MIT')
+depends=('glibc' 'nftables' 'iproute2' 'systemd')
+optdepends=(
+  'sing-box: default proxy engine (TUN mode)'
+  'polkit: run privileged actions through pkexec without sudo'
+)
+makedepends=('go')
+provides=('prx')
+# Adjust `source` to a tagged tarball or a git source before publishing.
+source=("$pkgname-$pkgver.tar.gz")
+sha256sums=('SKIP')
+
+build() {
+  cd "$srcdir/$pkgname-$pkgver"
+  export CGO_ENABLED=0
+  export GOFLAGS="-trimpath -mod=mod"
+  go build -ldflags "-s -w -X prx/internal/version.Version=$pkgver" -o prx ./cmd/prx
+  go build -ldflags "-s -w" -o prx-helper ./cmd/prx-helper
+}
+
+package() {
+  cd "$srcdir/$pkgname-$pkgver"
+
+  install -Dm755 prx "$pkgdir/usr/bin/prx"
+  install -Dm755 prx-helper "$pkgdir/usr/lib/prx/prx-helper"
+  install -Dm644 polkit/org.prx.policy "$pkgdir/usr/share/polkit-1/actions/org.prx.policy"
+  install -Dm644 systemd/prx-reapply.service "$pkgdir/usr/lib/systemd/system/prx-reapply.service"
+  install -Dm644 systemd/prx-reapply.timer "$pkgdir/usr/lib/systemd/system/prx-reapply.timer"
+  install -Dm644 man/prx.1 "$pkgdir/usr/share/man/man1/prx.1"
+  install -Dm644 man/prx-helper.1 "$pkgdir/usr/share/man/man1/prx-helper.1"
+  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}
diff --git a/polkit/org.prx.policy b/polkit/org.prx.policy
new file mode 100644
index 0000000..b99bc82
--- /dev/null
+++ b/polkit/org.prx.policy
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+
+  <vendor>prx</vendor>
+  <vendor_url>https://github.com/example/prx</vendor_url>
+
+  <!--
+    Maps the prx-helper executable to a dedicated polkit action. When the
+    unprivileged CLI runs `pkexec /usr/lib/prx/prx-helper`, polkit evaluates
+    org.prx.manage instead of the generic org.freedesktop.policykit.exec action.
+  -->
+  <action id="org.prx.manage">
+    <description>Manage prx proxy routing</description>
+    <message>Authentication is required to change proxy routing</message>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>auth_admin</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/lib/prx/prx-helper</annotate>
+  </action>
+
+</policyconfig>
diff --git a/systemd/prx-reapply.service b/systemd/prx-reapply.service
new file mode 100644
index 0000000..1b99350
--- /dev/null
+++ b/systemd/prx-reapply.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Re-apply prx proxy routing
+Documentation=man:prx(1)
+After=network-online.target
+Wants=network-online.target
+# Only run when prx was enabled (state snapshot exists).
+ConditionPathExists=/run/prx/state.json
+
+[Service]
+Type=oneshot
+# `prx on` is idempotent: it re-detects the gateway and refreshes the rules.
+ExecStart=/usr/bin/prx on
+RemainAfterExit=no
diff --git a/systemd/prx-reapply.timer b/systemd/prx-reapply.timer
new file mode 100644
index 0000000..a0deeaf
--- /dev/null
+++ b/systemd/prx-reapply.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Periodically re-apply prx proxy routing (handles DHCP/gateway changes)
+
+[Timer]
+Unit=prx-reapply.service
+OnBootSec=1min
+OnUnitActiveSec=5min
+Persistent=false
+
+[Install]
+WantedBy=timers.target