diff --git a/.github/workflows/nix.yaml b/.github/workflows/nix.yaml
index 4d5e6d5a..0b4cd06b 100644
--- a/.github/workflows/nix.yaml
+++ b/.github/workflows/nix.yaml
@@ -5,7 +5,6 @@ on:
   pull_request:
   push:
     branches: [main]
-    tags: ["v*"]
 
 jobs:
   build:
@@ -57,14 +56,6 @@ jobs:
         with:
           name: ${{ matrix.derivation }}-${{ matrix.nix-system }}
           path: ${{ matrix.derivation }}-${{ matrix.nix-system }}
-      - name: Release
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/v') && contains(matrix.derivation, 'static')
-        with:
-          files: |
-            ${{ matrix.derivation }}-${{ matrix.nix-system }}
-            LICENSE-MIT
-            LICENSE-APACHE
       - name: Deploy PDF artifacts
         if: ${{ matrix.derivation == 'whitepaper' && github.ref == 'refs/heads/main' }}
         uses: peaceiris/actions-gh-pages@v3
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 00000000..44c425a5
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,26 @@
+name: Release
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  release:
+    name: Build ${{ matrix.derivation }} on ${{ matrix.nix-system }}
+    runs-on:
+      - nix
+      - ${{ matrix.nix-system }}
+    strategy:
+      fail-fast: false
+      matrix:
+        nix-system:
+          - x86_64-linux
+          # - aarch64-linux
+    steps:
+      - uses: actions/checkout@v3
+      - name: Build release-package for ${{ matrix.nix-system }}
+        run: nix build .#release-package --print-build-logs
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            result/*
diff --git a/flake.nix b/flake.nix
index 9a4cc9c9..25244756 100644
--- a/flake.nix
+++ b/flake.nix
@@ -132,6 +132,29 @@
               default = rosenpass;
               rosenpass = rpDerivation pkgs;
               rosenpass-oci-image = rosenpassOCI "rosenpass";
+
+              # derivation for the release
+              release-package =
+                let
+                  version = cargoToml.package.version;
+                  package =
+                    if pkgs.hostPlatform.isLinux then
+                      packages.rosenpass-static
+                    else packages.rosenpass;
+                  oci-image =
+                    if pkgs.hostPlatform.isLinux then
+                      packages.rosenpass-static-oci-image
+                    else packages.rosenpass-oci-image;
+                in
+                pkgs.runCommandNoCC "lace-result" { }
+                  ''
+                    mkdir {bin,$out}
+                    cp ${./.}/rp bin/
+                    tar -cvf $out/rosenpass-${system}-${version}.tar bin/rp \
+                      -C ${package} bin/rosenpass
+                    cp ${oci-image} \
+                      $out/rosenpass-oci-image-${system}-${version}.tar.gz
+                  '';
             } // (if pkgs.stdenv.isLinux then rec {
               rosenpass-static = rpDerivation pkgs.pkgsStatic;
               rosenpass-static-oci-image = rosenpassOCI "rosenpass-static";