diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000000000000000000000000000000000000..a245f05262d4cfff0f1ceca9e86a2bf3c7d20169
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,41 @@
+name: Build release binaries
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build-release:
+    runs-on: "ubuntu-latest"
+
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.18.x
+
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Build
+        run: make
+
+      - name: Setup minimal git config
+        run: |
+          git config --global user.email "action@github.com"
+          git config --global user.name "GitHub Action"
+
+      - name: Test
+        run: make test
+
+      - name: Build binaries
+        run: make releases
+
+      - uses: "marvinpinto/action-automatic-releases@latest"
+        with:
+          repo_token: "${{ secrets.GITHUB_TOKEN }}"
+          draft: true
+          prerelease: false
+          files: dist/*
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 2307e5fe4330fccefead95364120f1adc5c32a99..729192e782a06ba114727503d54d091795b1bdbf 100644
--- a/Makefile
+++ b/Makefile
@@ -33,7 +33,7 @@ install:
 .PHONY: releases
 releases:
 	go generate
-	gox -ldflags "$(LDFLAGS)" -output "dist/{{.Dir}}_{{.OS}}_{{.Arch}}"
+	go run github.com/mitchellh/gox@v1.0.1 -ldflags "$(LDFLAGS)" -output "dist/{{.Dir}}_{{.OS}}_{{.Arch}}"
 
 secure: secure-practices secure-vulnerabilities