diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..2d464a9
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,193 @@
+name: Release
+
+on:
+  release:
+    types:
+      - published
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  linux:
+    name: Linux (${{ matrix.arch }})
+
+    runs-on: ubuntu-20.04
+
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - x86
+          - x64
+
+    steps:
+      - name: Clone
+        uses: actions/checkout@v3
+
+      - name: Dependencies (x86)
+        if: matrix.arch == 'x86'
+        run: |
+          sudo dpkg --add-architecture i386
+          sudo apt update
+          sudo apt install --allow-downgrades libpcre2-8-0=10.34-7
+          sudo apt install g++-multilib libsdl2-dev:i386 zlib1g-dev:i386
+
+      - name: Dependencies (x64)
+        if: matrix.arch == 'x64'
+        run: |
+          sudo apt update
+          sudo apt install libsdl2-dev zlib1g-dev
+
+      - name: Cache cmake build
+        uses: actions/cache@v3
+        with:
+          path: build
+          key: linux-${{ matrix.arch }}-cmake-v1
+
+      - name: Configure (x86)
+        if: matrix.arch == 'x86'
+        run: |
+          cmake \
+            -B build \
+            -D CMAKE_BUILD_TYPE=RelWithDebInfo \
+            -D CMAKE_TOOLCHAIN_FILE=cmake/toolchain/Linux32.cmake \
+            # EOL
+
+      - name: Configure (x64)
+        if: matrix.arch == 'x64'
+        run: |
+          cmake \
+            -B build \
+            -D CMAKE_BUILD_TYPE=RelWithDebInfo \
+            # EOL
+
+      - name: Build
+        run: |
+          cmake --build build -j $(nproc)
+
+      - name: Upload
+        run: |
+          cd build
+          tar -czvf fallout2-ce-linux-${{ matrix.arch }}.tar.gz fallout2-ce
+          gh release upload ${{ github.ref_name }} fallout2-ce-linux-${{ matrix.arch }}.tar.gz
+          rm fallout2-ce-linux-${{ matrix.arch }}.tar.gz
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  macos:
+    name: macOS
+
+    runs-on: macos-11
+
+    steps:
+      - name: Clone
+        uses: actions/checkout@v3
+
+      - name: Dependencies
+        run: |
+          brew install sdl2
+
+      - name: Import code signing certificates
+        uses: apple-actions/import-codesign-certs@v1
+        with:
+          p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_FILE_BASE64 }}
+          p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_PASSWORD }}
+
+      - name: Cache cmake build
+        uses: actions/cache@v3
+        with:
+          path: build
+          key: macos-cmake-v1
+
+      - name: Configure
+        run: |
+          cmake \
+            -B build \
+            -D CMAKE_BUILD_TYPE=RelWithDebInfo \
+            -D CPACK_BUNDLE_APPLE_CERT_APP="${{ secrets.APPLE_DEVELOPER_CERTIFICATE_IDENTITY }}" \
+            # EOL
+
+      - name: Build
+        run: |
+          cmake \
+            --build build \
+            -j $(sysctl -n hw.physicalcpu) \
+            --target package \
+            # EOL
+
+      - name: Notarize
+        run: |
+          brew install mitchellh/gon/gon
+          cat << EOF > config.json
+          {
+            "notarize": {
+              "path": "build/fallout2-ce.dmg",
+              "bundle_id": "$(/usr/libexec/PlistBuddy -c "Print :CFBundleIdentifier" build/fallout2-ce.app/Contents/Info.plist)",
+              "staple": true
+            }
+          }
+          EOF
+          gon config.json
+          rm config.json
+        env:
+          AC_USERNAME: ${{ secrets.APPLE_DEVELOPER_AC_USERNAME }}
+          AC_PASSWORD: ${{ secrets.APPLE_DEVELOPER_AC_PASSWORD }}
+
+      - name: Upload
+        run: |
+          cd build
+          cp fallout2-ce.dmg fallout2-ce-macos.dmg
+          gh release upload ${{ github.ref_name }} fallout2-ce-macos.dmg
+          rm fallout2-ce-macos.dmg
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  windows:
+    name: Windows (${{ matrix.arch }})
+
+    runs-on: windows-2019
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86
+            generator-platform: Win32
+          - arch: x64
+            generator-platform: x64
+
+    steps:
+      - name: Clone
+        uses: actions/checkout@v3
+
+      - name: Cache cmake build
+        uses: actions/cache@v3
+        with:
+          path: build
+          key: windows-${{ matrix.arch }}-cmake-v1
+
+      - name: Configure
+        run: |
+          cmake \
+            -B build \
+            -G "Visual Studio 16 2019" \
+            -A ${{ matrix.generator-platform }} \
+            # EOL
+
+      - name: Build
+        run: |
+          cmake \
+            --build build \
+            --config RelWithDebInfo \
+            # EOL
+
+      - name: Upload
+        run: |
+          cd build/RelWithDebInfo
+          7z a fallout2-ce-windows-${{ matrix.arch }}.zip fallout2-ce.exe
+          gh release upload ${{ github.ref_name }} fallout2-ce-windows-${{ matrix.arch }}.zip
+          rm fallout2-ce-windows-${{ matrix.arch }}.zip
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 127322e..4daf51a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -297,6 +297,13 @@ if(APPLE)
         "
         COMPONENT Runtime)
 
+    if (CPACK_BUNDLE_APPLE_CERT_APP)
+        install(CODE "
+            execute_process(COMMAND codesign --deep --force --options runtime --sign \"${CPACK_BUNDLE_APPLE_CERT_APP}\" ${CMAKE_BINARY_DIR}/${MACOSX_BUNDLE_BUNDLE_NAME}.app)
+            "
+            COMPONENT Runtime)
+    endif()
+
     set(CPACK_GENERATOR "DragNDrop")
     set(CPACK_DMG_DISABLE_APPLICATIONS_SYMLINK ON)
     set(CPACK_PACKAGE_FILE_NAME "fallout2-ce")