diff --git a/.github/workflows/binaries.yml b/.github/workflows/binaries.yml
new file mode 100644
index 0000000..cc7bc0c
--- /dev/null
+++ b/.github/workflows/binaries.yml
@@ -0,0 +1,52 @@
+name: binaries
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build ${{ matrix.pkg }} for ${{ matrix.goos }}-${{ matrix.goarch }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            goos: linux
+            goarch: amd64
+            pkg: gobal-player-tui
+            artifact_name: gobal-player-tui-linux-amd64
+          - os: ubuntu-latest
+            goos: linux
+            goarch: amd64
+            pkg: gobal-player-server
+            artifact_name: gobal-player-server-linux-amd64
+          - os: ubuntu-latest
+            goos: linux
+            goarch: arm64
+            pkg: gobal-player-server
+            artifact_name: gobal-player-server-linux-arm64
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - uses: taiki-e/install-action@just
+
+      - name: Run tests and publish coverage
+        run: just containerize "GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} just build-pkg ${{ matrix.pkg }}"
+
+      - name: Upload binaries to release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: bin/${{ matrix.artifact_name }}*
+          file_glob: true
+          asset_name: ${{ matrix.artifact_name }}
+          tag: ${{ github.ref }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cb3c68b..c56b91d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: taiki-e/install-action@just
 
       - name: Run tests and publish coverage
-        run: just test-cover-ci
+        run: just containerize "just test-cover"
 
       - name: Code Coverage Summary Report
         uses: irongut/CodeCoverageSummary@v1.3.0
diff --git a/.github/workflows/cd.yml b/.github/workflows/release.yml
similarity index 100%
rename from .github/workflows/cd.yml
rename to .github/workflows/release.yml
diff --git a/docker/go.Dockerfile b/docker/go.Dockerfile
index 1e2d479..dac21f4 100644
--- a/docker/go.Dockerfile
+++ b/docker/go.Dockerfile
@@ -3,3 +3,5 @@ FROM golang:1.22-bookworm
 RUN apt update && apt install -y libvlc-dev vlc-plugin-base vlc-plugin-video-output curl && rm -rf /var/lib/apt/lists/*
 
 RUN curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /bin
+
+ENV GOCACHE=/tmp/go
diff --git a/justfile b/justfile
index 616aceb..9da7c23 100644
--- a/justfile
+++ b/justfile
@@ -11,10 +11,6 @@ test-cover: mocks
     go install github.com/AlekSi/gocov-xml@latest
     gocov test `go list ./... | grep -v mocks` | gocov-xml > coverage.xml
 
-# run unit tests and produce coverage report (docker)
-test-cover-ci:
-    docker compose -f docker/docker-compose.build.yml run --rm -v $(pwd):/work -w /work go sh -c "just test-cover"
-
 # tidy modules
 tidy:
     go mod tidy
@@ -33,6 +29,12 @@ build:
     @mkdir -p bin/
     go build -o bin/ ./...
 
+# build a specific package
+build-pkg pkg:
+    @mkdir -p bin/
+    go build -o bin/{{pkg}}-${GOOS}-${GOARCH} ./cmd/{{pkg}}
+    @cd bin && sha256sum {{pkg}}-${GOOS}-${GOARCH} > {{pkg}}-${GOOS}-${GOARCH}.sha256
+
 # generate mocks
 mocks:
     @go install github.com/vektra/mockery/v2@v2.42.0
@@ -64,3 +66,13 @@ hooks:
     go install -v github.com/go-critic/go-critic/cmd/gocritic@latest
     command -v pre-commit
     pre-commit install
+
+# run a command in a containerized environment
+containerize +CMD:
+    docker compose \
+    -f docker/docker-compose.build.yml run \
+    --rm \
+    -v $(pwd):/work \
+    -w /work \
+    -u `id -u`:`id -g` \
+    go sh -c "{{CMD}}"