diff --git a/.github/workflows/build-pr-cmk.yml b/.github/workflows/build-pr-cmk.yml
new file mode 100644
index 0000000..6683853
--- /dev/null
+++ b/.github/workflows/build-pr-cmk.yml
@@ -0,0 +1,130 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Build cmk binaries on PR
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
+    env:
+      GITHUB_TOKEN: ""
+    steps:
+      - name: Checkout PR HEAD
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+
+      - name: Build dist
+        id: build
+        run: make dist
+        continue-on-error: true
+
+      - name: Upload zipped dist artifact
+        id: upload_artifact
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cmk-binaries.pr${{ github.event.pull_request.number }}
+          path: dist/
+          if-no-files-found: error
+          retention-days: 10
+
+      - name: Expose build outcome & artifact link
+        id: meta
+        if: always()
+        run: |
+          echo "outcome=${{ steps.build.outcome }}" >> $GITHUB_OUTPUT
+          # upload-artifact v4 exposes artifact-url output; echo empty if missing
+          echo "artifact_url=${{ steps.upload_artifact.outputs.artifact-url }}" >> $GITHUB_OUTPUT
+
+  comment:
+    needs: build
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Comment or update cmk build artifact on PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { execSync } = require('child_process');
+            const issue_number = context.payload.pull_request.number;
+            const identifier = "cmk-build-artifact-comment";
+            const outcome = "${{ needs.build.outputs.outcome || steps.build.outcome }}".trim() || "${{ needs.build.outputs.outcome }}";
+            // Prefer job output from previous step:
+            const buildOutcome = "${{ needs.build.outputs.outcome }}";
+            const artifactUrl = "${{ needs.build.outputs.artifact_url }}";
+            const runId = "${{ github.run_id }}";
+            const repo = "${{ github.repository }}";
+
+            // Fallback: use provided build outcome var if needs.* resolution is odd
+            const finalOutcome = buildOutcome || outcome || 'failure';
+
+            let commentBody = `<!-- ${identifier} -->\n`;
+
+            if (finalOutcome === 'success' && artifactUrl) {
+              const expiryDate = execSync("date -d '+10 days' '+%B %d, %Y'").toString().trim();
+              commentBody += `✅ Build complete for PR #${issue_number}.\n\n`;
+              commentBody += `🔗 Download the [cmk binaries](${artifactUrl}) (expires on ${expiryDate})`;
+            } else {
+              commentBody += `❌ Build failed for PR #${issue_number}.\n\n`;
+              commentBody += `See the [workflow run](https://github.com/${repo}/actions/runs/${runId}) for details.`;
+            }
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number
+            });
+
+            const existing = comments.find(c =>
+              c.user.login === 'github-actions[bot]' &&
+              c.body.includes(identifier)
+            );
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body: commentBody
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number,
+                body: commentBody
+              });
+            }