diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 41cd62a879..f02d079323 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -104,3 +104,53 @@ jobs:
         with:
           name: CHECKSUMS
           path: /tmp/artifact/CHECKSUMS
+
+  release:
+    needs: artifact
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/download-artifact@v7
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Assemble release assets
+        run: |
+          set -ex
+          VERSION="${GITHUB_REF_NAME}"
+          mkdir -p release
+          for ARCH in amd64 arm64 ppc64le riscv64 s390x; do
+            mv "artifacts/crun-linux-${ARCH}" "release/crun-${VERSION}-linux-${ARCH}"
+            mv "artifacts/crun-linux-${ARCH}-disable-systemd" "release/crun-${VERSION}-linux-${ARCH}-disable-systemd"
+          done
+          mv artifacts/crun.tar.gz "release/crun-${VERSION}.tar.gz"
+          mv artifacts/crun.tar.zst "release/crun-${VERSION}.tar.zst"
+          (cd release && sha256sum -- * > CHECKSUMS)
+
+      - name: Extract release notes from NEWS
+        run: |
+          awk -v hdr="* crun-${GITHUB_REF_NAME}" '
+            $0 == hdr { capture = 1; next }
+            capture && /^\* crun-/ { exit }
+            capture { print }
+          ' NEWS > release-notes.md
+          if ! grep -q '[^[:space:]]' release-notes.md; then
+            echo "no '* crun-${GITHUB_REF_NAME}' section found in NEWS" >&2
+            exit 1
+          fi
+          cat release-notes.md
+
+      - name: Create draft release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --draft \
+            --title "crun ${GITHUB_REF_NAME}" \
+            --notes-file release-notes.md \
+            release/*
diff --git a/build-aux/download-release.sh b/build-aux/download-release.sh
new file mode 100755
index 0000000000..4473dd8d75
--- /dev/null
+++ b/build-aux/download-release.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# Download the assets of a (draft) GitHub release into a local directory so
+# they can be signed with GPG before publishing.
+#
+# Usage: download-release.sh [VERSION]
+#
+# VERSION defaults to the version reported by git-version-gen (the current
+# checkout).  The repository is auto-detected from the git remotes; override
+# it with REPO=owner/name.  The output directory defaults to release-$VERSION
+# and can be overridden with OUTDIR.
+
+if ! command -v gh >/dev/null 2>&1; then
+    echo "required tool not found: gh" >&2
+    exit 1
+fi
+
+VERSION=${1:-}
+if test "$VERSION" = ""; then
+    VERSION="$("$(dirname "$0")/git-version-gen" --prefix "" .)"
+fi
+
+OUTDIR=${OUTDIR:-release-$VERSION}
+mkdir -p "$OUTDIR"
+
+GH_ARGS=(release download "$VERSION" --dir "$OUTDIR" --clobber)
+if test "${REPO:-}" != ""; then
+    GH_ARGS+=(--repo "$REPO")
+fi
+
+gh "${GH_ARGS[@]}"
+
+echo "downloaded release $VERSION into $OUTDIR" >&2
+echo "sign the assets with, e.g.:" >&2
+echo "  for i in \"$OUTDIR\"/*; do gpg2 -b --armour \"\$i\"; done" >&2
diff --git a/build-aux/release.sh b/build-aux/release.sh
index 8890cefca1..91490d5cce 100755
--- a/build-aux/release.sh
+++ b/build-aux/release.sh
@@ -7,6 +7,28 @@ SKIP_CHECKS=${SKIP_CHECKS:-}
 
 NIX_IMAGE=${NIX_IMAGE:-docker.io/nixos/nix:2.35.1}
 
+ARCHES=(amd64 arm64 ppc64le riscv64 s390x)
+
+# Fail fast if a required tool is missing, before the long build starts.
+REQUIRED_TOOLS=("${RUNTIME:-podman}" git make)
+if test "$SKIP_GPG" = ""; then
+    REQUIRED_TOOLS+=(gpg2)
+fi
+for tool in "${REQUIRED_TOOLS[@]}"; do
+    if ! command -v "$tool" >/dev/null 2>&1; then
+        echo "required tool not found: $tool" >&2
+        exit 1
+    fi
+done
+
+# Remove generated intermediates on exit so they do not linger after a
+# successful run or a failure.  OUTDIR is left untouched for inspection.
+cleanup() {
+    rm -rf result
+    rm -f .tarball-git-version.h
+}
+trap cleanup EXIT
+
 test -e Makefile && make distclean
 
 ./autogen.sh
@@ -17,7 +39,11 @@ make -j "$(nproc)"
 
 VERSION="$("$(dirname "$0")/git-version-gen" --prefix "" .)"
 if test "$SKIP_CHECKS" = ""; then
-    grep "$VERSION" NEWS
+    if ! grep -Fqx -- "* crun-$VERSION" NEWS; then
+        echo "no '* crun-$VERSION' entry found in NEWS" >&2
+        echo "(add the release notes, or commit a tag if the version is '-dirty')" >&2
+        exit 1
+    fi
 fi
 
 OUTDIR=${OUTDIR:-release-$VERSION}
@@ -65,7 +91,7 @@ fi
 git_commit=$(git rev-parse HEAD)
 printf '/* autogenerated.  */\n#ifndef GIT_VERSION\n# define GIT_VERSION "%s"\n#endif\n' "$git_commit" > .tarball-git-version.h
 
-for ARCH in amd64 arm64 ppc64le riscv64 s390x; do
+for ARCH in "${ARCHES[@]}"; do
     "${BUILD_CMD[@]}" "path:.#crun-static-${ARCH}"
     cp ./result/bin/crun "$OUTDIR/crun-$VERSION-linux-${ARCH}"
     rm -rf result
diff --git a/cfg.mk b/cfg.mk
index ec833f91ca..adf0f3f382 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -15,7 +15,8 @@ local-checks-to-skip = \
     sc_cast_of_x_alloc_return_value \
     sc_indent \
     sc_prohibit_always-defined_macros \
-    sc_prohibit_gnu_make_extensions
+    sc_prohibit_gnu_make_extensions \
+    sc_two_space_separator_in_usage
 
 sc_prohibit_sprintf:
 	@prohibit='\<sprintf *\('					\