diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..b231934
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,32 @@
+name: Release
+
+# Build and publish cross-platform binaries when a vX.Y.Z tag is pushed.
+# The tag itself is still cut by a human (after maintainer confirmation) — this
+# workflow only turns an existing tag into prebuilt archives + a GitHub Release.
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # full history for the changelog
+      - uses: actions/setup-go@v6
+        with:
+          go-version: "1.25.x"
+      - name: Run GoReleaser
+        # Third-party action pinned to a full commit SHA (supply-chain policy).
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index dd205f6..43ffe1c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -213,5 +213,7 @@ $RECYCLE.BIN/
 *.db
 /starcli*
 /*.yaml
+!/.goreleaser.yaml
 /*.star
 /coverage.*
+dist/
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..bc75ba0
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,85 @@
+# GoReleaser configuration for starcli — cross-platform prebuilt binaries so the
+# CLI can be installed without a Go toolchain. Validate/iterate locally with:
+#   go run github.com/goreleaser/goreleaser/v2@latest check
+#   go run github.com/goreleaser/goreleaser/v2@latest release --snapshot --clean --skip=publish
+# Releases are produced on a vX.Y.Z tag by .github/workflows/release.yml.
+version: 2
+
+project_name: starcli
+
+before:
+  hooks:
+    - go mod download
+
+builds:
+  - id: starcli
+    main: .
+    binary: starcli
+    # modernc/sqlite is pure Go, so the whole binary builds with CGO disabled —
+    # which is what makes static, cross-compiled binaries possible here.
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    flags:
+      - -trimpath
+    # Inject the same version vars the Makefile sets (package config), so the
+    # released binary's `--version` banner is populated.
+    ldflags:
+      - -s -w
+      - -X github.com/1set/starcli/config.AppName=starcli
+      - -X github.com/1set/starcli/config.GitSummary={{ .Version }}
+      - -X github.com/1set/starcli/config.GitCommit={{ .ShortCommit }}
+      - -X github.com/1set/starcli/config.GitBranch={{ .Branch }}
+      - -X github.com/1set/starcli/config.BuildDate={{ .Date }}
+
+archives:
+  - id: starcli
+    ids:
+      - starcli
+    # tar.gz everywhere, zip on Windows.
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    name_template: >-
+      {{ .ProjectName }}_{{ .Version }}_
+      {{- if eq .Os "darwin" }}macOS{{ else }}{{ .Os }}{{ end }}_{{ .Arch }}
+    files:
+      - README.md
+      - LICENSE*
+
+checksum:
+  name_template: "checksums.txt"
+
+snapshot:
+  version_template: "{{ incpatch .Version }}-snapshot-{{ .ShortCommit }}"
+
+changelog:
+  sort: asc
+  use: github
+  filters:
+    exclude:
+      - "^\\[doc\\]"
+      - "^\\[ci\\]"
+      - "^\\[test\\]"
+      - "^\\[chore\\]"
+      - "merge conflict"
+      - "Merge pull request"
+      - "Merge branch"
+
+release:
+  github:
+    owner: 1set
+    name: starcli
+  # Match the existing release style: explicit, not auto-prerelease.
+  prerelease: auto
+  draft: false
+  mode: keep-existing