diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..211c866
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,62 @@
+name: goreleaser
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/release.yml
+      - .goreleaser.yaml
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+    
+      - uses: actions/setup-go@v5
+        with:
+          go-version: v1.22.10
+    
+      - name: Delete non-semver tags
+        run: 'git tag -d $(git tag -l | grep -v "^v")'
+      
+      - name: Set LDFLAGS
+        run: echo LDFLAGS="$(make ldflags)" >> $GITHUB_ENV
+    
+      - name: Run GoReleaser on tag
+        if: github.event_name != 'pull_request'
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --timeout 60m
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    
+      - name: Run GoReleaser on pull request
+        if: github.event_name == 'pull_request'
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --timeout 60m --snapshot
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    
+      - uses: actions/upload-artifact@v4
+        if: github.event_name == 'pull_request'
+        with:
+          name: binaries
+          path: dist/*.tar.gz
diff --git a/.gitignore b/.gitignore
index db758ac..9526eb7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 /_build/
+/dist/
 /_tools/
 /vendor/
 /.kcp.e2e/
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..55476a3
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,37 @@
+# Copyright 2025 The KCP Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+builds:
+  - id: "api-syncagent"
+    main: ./cmd/api-syncagent
+    binary: api-syncagent
+    ldflags:
+      - "{{ .Env.LDFLAGS }}"
+    goos:
+      - linux
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    env:
+      - CGO_ENABLED=0
+
+archives:
+  - id: api-syncagent
+    builds:
+      - api-syncagent
+
+release:
+  draft: true
+  mode: keep-existing
diff --git a/Makefile b/Makefile
index 504a8f3..b81fc7d 100644
--- a/Makefile
+++ b/Makefile
@@ -30,6 +30,9 @@ GOOS ?= $(shell go env GOOS)
 .PHONY: all
 all: build test
 
+ldflags:
+	@echo $(LDFLAGS)
+
 .PHONY: build
 build: $(CMD)