diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
new file mode 100644
index 0000000..0ab5cec
--- /dev/null
+++ b/.github/workflows/release-binaries.yml
@@ -0,0 +1,99 @@
+name: release binaries
+
+# okrun and okld as programs of each system and architecture, attached to a
+# release: what a machine without mcpp installs to run ok images (the
+# xim-pkgindex `okrun` package). Dispatched with the release's tag; each archive
+# is `mcpp pack` of the tool, a static program on Linux, and carries its
+# mcpp-package.json, from which `mcpp emit xpkg --package` writes the index
+# entry.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The release tag the binaries are built from and attached to (e.g. 0.1.3)"
+        required: true
+      mcpp_ref:
+        description: "Branch of mcpp-community/mcpp to build with (empty = the released mcpp)"
+        required: false
+        default: ""
+
+permissions:
+  contents: write
+
+env:
+  MCPP_SOURCE_REF: ${{ github.event.inputs.mcpp_ref || vars.MCPP_SOURCE_REF || '' }}
+  MCPP_VERSION: 2026.10.26.2
+  XLINGS_VERSION: v2026.10.26.1
+  XLINGS_NON_INTERACTIVE: '1'
+
+jobs:
+  binaries:
+    name: ${{ matrix.id }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Linux: static (musl), the one form that runs on every distribution.
+          - { os: ubuntu-24.04,     id: linux-x86_64,   pack: '--linkage static' }
+          - { os: ubuntu-24.04-arm, id: linux-aarch64,  pack: '--linkage static' }
+          - { os: macos-15,         id: macos-aarch64,  pack: '' }
+          - { os: windows-2022,     id: windows-x86_64, pack: '' }
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag }}
+
+      - name: Install xlings and mcpp (Unix)
+        if: runner.os != 'Windows'
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh \
+            | bash -s "$XLINGS_VERSION"
+          echo "$HOME/.xlings/subos/current/bin" >> "$GITHUB_PATH"
+
+      - name: Install xlings and mcpp (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          irm https://d2learn.org/xlings-install.ps1.txt | iex
+          "$env:USERPROFILE\.xlings\subos\current\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+      - name: The mcpp that packs
+        run: |
+          for attempt in 1 2 3 4 5 6; do
+            xlings update > /dev/null 2>&1 || true
+            if xlings install "mcpp@$MCPP_VERSION" -y -g; then break; fi
+            [ "$attempt" = 6 ] && { echo "::error::mcpp could not be installed"; exit 1; }
+            sleep 60
+          done
+          mcpp self config --mirror GLOBAL
+          if [ -n "${MCPP_SOURCE_REF:-}" ]; then
+            src="$RUNNER_TEMP/mcpp-src"
+            git clone --quiet --depth 1 --branch "$MCPP_SOURCE_REF" https://github.com/mcpp-community/mcpp.git "$src"
+            rm -f "$src/.xlings.json"
+            ( cd "$src" && MCPP_JOBS=2 mcpp build --release )
+            built=$(find "$src/target" -type f \( -name mcpp -o -name mcpp.exe \) -path '*/bin/*' | head -1)
+            [ -n "$built" ] || { echo "::error::mcpp did not build from $MCPP_SOURCE_REF"; exit 1; }
+            echo "$(cd "$(dirname "$built")" && pwd)" >> "$GITHUB_PATH"
+          fi
+
+      - name: okrun and okld, packed
+        working-directory: tools
+        run: |
+          tag='${{ github.event.inputs.tag }}'
+          mkdir -p ../out
+          for tool in okrun okld; do
+            mcpp pack "$tool" ${{ matrix.pack }} --pkg-format zip -o "$tool-$tag-${{ matrix.id }}.zip"
+            cp "target/dist/$tool-$tag-${{ matrix.id }}.zip" ../out/
+          done
+          ls -l ../out
+
+      - name: Attached to the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload '${{ github.event.inputs.tag }}' out/* --clobber