diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..005ccd0
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,61 @@
+name: Build and release
+on:
+  # Runs automatically when a tag beginning with 'v' (i.e. a versioned release) is pushed.
+  push:
+    tags:
+      - v*
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build-release:
+    runs-on: ubuntu-20.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/setup-go@v3
+        with:
+          go-version: '1.18.1'
+
+      - uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: build binary
+        run: go build
+
+      - name: install nfpm
+        run: go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.15.1
+
+      - name: build deb
+        run: nfpm package -p deb -t unbound_exporter.deb
+
+      - name: upload deb
+        uses: actions/upload-artifact@v3
+        with:
+          name: unbound_exporter deb artifact
+          path: unbound_exporter.deb
+
+  push-release:
+    if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
+    needs: build-release
+    runs-on: ubuntu-20.04
+    # Overrides the org default of 'read'. This allows us to upload and post the
+    # resulting package file as part of a release.
+    permissions:
+      contents: write
+    steps:
+      - name: Download release artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: unbound_exporter deb artifact
+
+      - name: rename
+        run: mv unbound_exporter.deb unbound_exporter-${GITHUB_REF_NAME}.x86_64.deb
+
+      - name: push release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        # https://cli.github.com/manual/gh_release_create
+        run: gh release create "${GITHUB_REF_NAME}" unbound_exporter-${GITHUB_REF_NAME}.x86_64.deb
diff --git a/nfpm.yaml b/nfpm.yaml
new file mode 100644
index 0000000..d506f65
--- /dev/null
+++ b/nfpm.yaml
@@ -0,0 +1,12 @@
+name: "unbound_exporter"
+arch: "amd64"
+platform: "linux"
+version: "${GITHUB_REF_NAME}"
+description: "Prometheus exporter for Unbound recursive DNS resolver"
+vendor: "ISRG"
+maintainer: "ISRG Team <opensource@letsencrypt.org>"
+homepage: "https://github.com/letsencrypt/unbound_exporter"
+license: "Apache 2.0"
+contents:
+- src: unbound_exporter
+  dst: /usr/bin/unbound_exporter