diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..e0b2955
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,94 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build and release (e.g. v0.1.0)"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    name: Build linux/${{ matrix.goarch }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        goarch: [amd64, arm64]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.23"
+
+      - name: Build
+        env:
+          GOOS: linux
+          GOARCH: ${{ matrix.goarch }}
+          CGO_ENABLED: 0
+        run: |
+          tag="${{ inputs.tag || github.ref_name }}"
+          version="${tag#v}"
+          go build -trimpath -ldflags="-s -w -X main.version=${version}" \
+            -o "msvc-go-wine-linux-${{ matrix.goarch }}" ./cmd/msvc-go-wine
+
+      - name: Verify it runs
+        if: matrix.goarch == 'amd64'
+        run: ./msvc-go-wine-linux-amd64 version
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: msvc-go-wine-linux-${{ matrix.goarch }}
+          path: msvc-go-wine-linux-${{ matrix.goarch }}
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    name: Publish release
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Download all architectures
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: msvc-go-wine-linux-*
+          merge-multiple: true
+
+      - name: Checksums
+        run: sha256sum msvc-go-wine-linux-* > SHA256SUMS
+
+      - name: Create or update GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          tag="${{ inputs.tag || github.ref_name }}"
+          if ! gh release view "$tag" >/dev/null 2>&1; then
+            gh release create "$tag" \
+              --title "msvc-go-wine $tag" \
+              --notes "Linux amd64/arm64 binaries built by CI from this tag. See README.md for install instructions."
+          fi
+          gh release upload "$tag" \
+            msvc-go-wine-linux-* \
+            SHA256SUMS \
+            --clobber
diff --git a/cmd/msvc-go-wine/main.go b/cmd/msvc-go-wine/main.go
index 737eddd..abbc8d5 100644
--- a/cmd/msvc-go-wine/main.go
+++ b/cmd/msvc-go-wine/main.go
@@ -15,6 +15,10 @@ import (
 	"github.com/Cheviiot/msvc-go-wine/internal/wrapper"
 )
 
+// version is set at build time via -ldflags "-X main.version=X.Y.Z";
+// left as "dev" for plain `go build`/`go run`.
+var version = "dev"
+
 func main() {
 	base := filepath.Base(os.Args[0])
 	name := strings.TrimSuffix(strings.ToLower(base), ".exe")
@@ -43,7 +47,7 @@ func runCLI(args []string) int {
 	case "env":
 		return runEnv(args[1:])
 	case "version":
-		fmt.Println("msvc-go-wine dev")
+		fmt.Println("msvc-go-wine " + version)
 		return 0
 	case "-h", "--help", "help":
 		printUsage()