diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
new file mode 100644
index 0000000..a3729b3
--- /dev/null
+++ b/.github/workflows/build-binaries.yml
@@ -0,0 +1,118 @@
+name: "Build binaries"
+on:
+  workflow_call:
+    inputs:
+      plan: # https://opensource.axo.dev/cargo-dist/book/ci/customizing.html
+        required: true
+        type: string
+  pull_request:
+    paths:
+      - .github/workflows/build-binaries.yml
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  APP_NAME: tee-rs
+  CARGO_INCREMENTAL: 0
+  CARGO_NET_RETRY: 10
+  RUSTFLAGS: "-D warnings -W unreachable-pub"
+  RUSTUP_MAX_RETRIES: 10
+  FETCH_DEPTH: 0 # pull in the tags for the version string
+  MACOSX_DEPLOYMENT_TARGET: 13.0
+defaults:
+  run:
+    shell: bash -eux -o pipefail {0}
+jobs:
+  dist:
+    strategy:
+      matrix:
+        include:
+          # - os: windows-latest
+          #   target: x86_64-pc-windows-msvc
+          #   code-target: win32-x64
+          # - os: windows-latest
+          #   target: i686-pc-windows-msvc
+          # - os: windows-latest
+          #   target: aarch64-pc-windows-msvc
+          #   code-target: win32-arm64
+          - os: ubuntu-20.04
+            target: x86_64-unknown-linux-gnu
+            # https://blog.rust-lang.org/2022/08/01/Increasing-glibc-kernel-requirements.html
+            glib_version: 2.17
+          - os: ubuntu-20.04
+            target: aarch64-unknown-linux-gnu
+            glib_version: 2.17
+          - os: ubuntu-20.04
+            target: x86_64-unknown-linux-musl
+          - os: ubuntu-20.04
+            target: aarch64-unknown-linux-musl
+          - os: macos-13
+            target: x86_64-apple-darwin
+          - os: macos-13
+            target: aarch64-apple-darwin
+    name: dist (${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Prepare
+        run: |
+          {
+            echo XDG_CONFIG_HOME="${{ runner.temp }}/.config"
+            echo XDG_CACHE_HOME="${{ runner.temp }}/.cache"
+            echo XDG_DATA_HOME="${{ runner.temp }}/.local/share"
+            echo XDG_BIN_HOME="${{ runner.temp }}/.local/bin"
+            echo CARGO_HOME="${{ runner.temp }}/.cargo"
+            echo PYTHONUSERBASE="${{ runner.temp }}/.local"
+          } >> "$GITHUB_ENV"
+          {
+            echo "${{ runner.temp }}/.local/bin"
+          } >> "$GITHUB_PATH"
+      # - name: Install Rust
+      #   run: |
+      #     curl --proto '=https' --tlsv1.2 --retry 10 --retry-connrefused -fsSL "https://sh.rustup.rs" \
+      #       | sh -s -- --profile minimal --default-toolchain none -y
+      #     echo "${CARGO_HOME:-$HOME/.cargo}/bin" >> $GITHUB_PATH
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Update pip
+        run: pip install --user -U pip
+      - name: Install cargo-zigbuild (and ziglang)
+        run: pip install --user cargo-zigbuild
+      - name: Install Rust toolchain
+        run: |
+          rustup update --no-self-update stable
+          rustup target add ${{ matrix.target }}
+          rustup component add rust-src
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: ${{ env.FETCH_DEPTH }}
+      - name: Dist
+        run: |
+          target="${{ matrix.target }}"
+          if [[ -n "${{ matrix.glib_version }}" ]]; then
+            target="${target}.${{ matrix.glib_version }}"
+          fi
+          cargo zigbuild --target="${target}" --release
+      - name: Archive binary for Unix-like systems
+        if: ${{ !contains(matrix.target, 'windows-msvc') }}
+        run: |
+          ARCHIVE_NAME="${{ env.APP_NAME }}-${{ matrix.target }}"
+          ARCHIVE_FILE="$ARCHIVE_NAME.tar.gz"
+
+          mkdir -p "$ARCHIVE_NAME"
+          cp "target/${{ matrix.target }}/release/${{ env.APP_NAME }}" "$ARCHIVE_NAME/${{ env.APP_NAME }}"
+          tar czvf "$ARCHIVE_FILE" "$ARCHIVE_NAME"
+          shasum -a 256 "$ARCHIVE_FILE" > "$ARCHIVE_FILE.sha256"
+      # - name: Archive binary for Windows
+      #   if: ${{ contains(matrix.target, 'windows-msvc') }}
+      #   run: | # TODO: windows support
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-${{ matrix.target }}
+          retention-days: 1
+          path: |
+            *.tar.gz
+            *.sha256
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 42b4067..1fa6749 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -86,80 +86,20 @@ jobs:
           name: artifacts-plan-dist-manifest
           path: plan-dist-manifest.json
 
-  # Build and packages all the platform-specific things
-  build-local-artifacts:
-    name: build-local-artifacts (${{ join(matrix.targets, ', ') }})
-    # Let the initial task tell us to not run (currently very blunt)
+  custom-build-binaries:
     needs:
       - plan
-    if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }}
-    strategy:
-      fail-fast: false
-      # Target platforms/runners are computed by cargo-dist in create-release.
-      # Each member of the matrix has the following arguments:
-      #
-      # - runner: the github runner
-      # - dist-args: cli flags to pass to cargo dist
-      # - install-dist: expression to run to install cargo-dist on the runner
-      #
-      # Typically there will be:
-      # - 1 "global" task that builds universal installers
-      # - N "local" tasks that build each platform's binaries and platform-specific installers
-      matrix: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix }}
-    runs-on: ${{ matrix.runner }}
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
-    steps:
-      - name: enable windows longpaths
-        run: |
-          git config --global core.longpaths true
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-      - name: Install cargo-dist
-        run: ${{ matrix.install_dist }}
-      # Get the dist-manifest
-      - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: artifacts-*
-          path: target/distrib/
-          merge-multiple: true
-      - name: Install dependencies
-        run: |
-          ${{ matrix.packages_install }}
-      - name: Build artifacts
-        run: |
-          # Actually do builds and make zips and whatnot
-          cargo dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
-          echo "cargo dist ran successfully"
-      - id: cargo-dist
-        name: Post-build
-        # We force bash here just because github makes it really hard to get values up
-        # to "real" actions without writing to env-vars, and writing to env-vars has
-        # inconsistent syntax between shell and powershell.
-        shell: bash
-        run: |
-          # Parse out what we just built and upload it to scratch storage
-          echo "paths<<EOF" >> "$GITHUB_OUTPUT"
-          jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
-
-          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
-      - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
-        with:
-          name: artifacts-build-local-${{ join(matrix.targets, '_') }}
-          path: |
-            ${{ steps.cargo-dist.outputs.paths }}
-            ${{ env.BUILD_MANIFEST_NAME }}
+    if: ${{ needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload' }}
+    uses: ./.github/workflows/build-binaries.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit
 
   # Build and package all the platform-agnostic(ish) things
   build-global-artifacts:
     needs:
       - plan
-      - build-local-artifacts
+      - custom-build-binaries
     runs-on: "ubuntu-20.04"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -204,10 +144,10 @@ jobs:
   host:
     needs:
       - plan
-      - build-local-artifacts
+      - custom-build-binaries
       - build-global-artifacts
     # Only run if we're "publishing", and only if local and global didn't fail (skipped is fine)
-    if: ${{ always() && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
+    if: ${{ always() && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.custom-build-binaries.result == 'skipped' || needs.custom-build-binaries.result == 'success') }}
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     runs-on: "ubuntu-20.04"
diff --git a/dist-workspace.toml b/dist-workspace.toml
index 71c420a..294ea94 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -9,9 +9,17 @@ cargo-dist-version = "0.23.0"
 ci = "github"
 # The installers to generate for each app
 installers = ["shell", "powershell"]
+# The archive format to use for windows builds (defaults .zip)
+windows-archive = ".zip"
+# The archive format to use for non-windows builds (defaults .tar.xz)
+unix-archive = ".tar.gz"
 # Target platforms to build apps for (Rust target-triple syntax)
-targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "x86_64-unknown-linux-gnu", "x86_64-unknown-linux-musl"]
+targets = ["aarch64-apple-darwin", "aarch64-unknown-linux-gnu", "aarch64-unknown-linux-musl", "x86_64-apple-darwin", "x86_64-unknown-linux-gnu", "x86_64-unknown-linux-musl"]
 # Path that installers should place binaries in
 install-path = "CARGO_HOME"
 # Whether to install an updater program
 install-updater = false
+# Whether CI should include auto-generated code to build local artifacts
+build-local-artifacts = false
+# Local artifacts jobs to run in CI
+local-artifacts-jobs = ["./build-binaries"]