diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..fe7ed88
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,45 @@
+name: Build and release
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  build:
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build the app
+        run: >-
+          xcodebuild -project CapsLockSwitcher.xcodeproj -scheme CapsLockSwitcher
+          -configuration Release -derivedDataPath build
+          ARCHS="arm64 x86_64" ONLY_ACTIVE_ARCH=NO
+          CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY=- DEVELOPMENT_TEAM=
+          CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO build
+      - name: Check and package the app
+        run: |
+          app="build/Build/Products/Release/CapsLockSwitcher.app"
+          lipo "$app/Contents/MacOS/CapsLockSwitcher" -verify_arch arm64
+          lipo "$app/Contents/MacOS/CapsLockSwitcher" -verify_arch x86_64
+          codesign --verify --deep --strict "$app"
+          ditto -c -k --keepParent "$app" CapsLockSwitcher.app.zip
+          ditto -x -k CapsLockSwitcher.app.zip "$RUNNER_TEMP/archive-check"
+          test -x "$RUNNER_TEMP/archive-check/CapsLockSwitcher.app/Contents/MacOS/CapsLockSwitcher"
+          shasum -a 256 CapsLockSwitcher.app.zip > CapsLockSwitcher.app.zip.sha256
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-files
+          path: CapsLockSwitcher.app.zip*
+  release:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-files
+      - name: Create the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: gh release create "$GITHUB_REF_NAME" CapsLockSwitcher.app.zip* --verify-tag --generate-notes