diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..9dd8a0e
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,40 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "[0-9]+.*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Build and Release
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build universal binary
+        run: swift build -c release --arch arm64 --arch x86_64
+
+      - name: Verify binary
+        run: |
+          .build/apple/Products/Release/zeplin-cli --version
+          file .build/apple/Products/Release/zeplin-cli
+
+      - name: Package
+        run: |
+          cd .build/apple/Products/Release
+          tar czf zeplin-cli-macos.tar.gz zeplin-cli
+          shasum -a 256 zeplin-cli-macos.tar.gz
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          SHA256=$(shasum -a 256 .build/apple/Products/Release/zeplin-cli-macos.tar.gz | awk '{print $1}')
+          gh release create "${{ github.ref_name }}" \
+            .build/apple/Products/Release/zeplin-cli-macos.tar.gz \
+            --title "${{ github.ref_name }}" \
+            --notes "SHA256: \`${SHA256}\`"
diff --git a/CLAUDE.md b/CLAUDE.md
index e65de92..329955f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -22,10 +22,10 @@ Uses Swift Testing (`@Suite`, `@Test`, `#expect`, `#require`), not XCTest. Comma
 
 ## Releases
 
-- **Never create GitHub releases.** Tag only.
-- Homebrew formula in `yapstudios/homebrew-tap` uses the tag tarball. Update URL and SHA256 when releasing.
-- Mint uses the git tag directly.
 - Update version in `Sources/ZeplinCLI/CLI.swift` and `CHANGELOG.md` before tagging.
+- Pushing a tag triggers `.github/workflows/release.yml`, which builds a universal binary and creates a GitHub Release with `zeplin-cli-macos.tar.gz` attached.
+- After the release, update the Homebrew formula in `yapstudios/homebrew-tap` with the new URL and SHA256 from the release notes.
+- Mint uses the git tag directly (no formula update needed).
 
 ## Dependencies
 
diff --git a/README.md b/README.md
index 214751f..eada5c4 100644
--- a/README.md
+++ b/README.md
@@ -127,7 +127,7 @@ To update later:
 brew update && brew upgrade zeplin-cli
 ```
 
-This builds from source and automatically installs shell completions for zsh, bash, and fish.
+This installs a prebuilt universal binary and shell completions for zsh, bash, and fish.
 
 ### Using Mint