diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1037127..202394a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,6 +2,10 @@ name: Release
 
 on:
   push:
+    branches:
+      - master
+    paths:
+      - ".github/workflows/release.yml"
     tags:
       - "*"
 
@@ -28,14 +32,21 @@ jobs:
         run: |
           set -euo pipefail
 
-          current_tag="$(git describe --tags --exact-match)"
+          if [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then
+            current_tag="${GITHUB_REF_NAME}"
+          else
+            current_tag="$(git describe --tags --abbrev=0)"
+          fi
           version="${current_tag#v}"
+          tag_target="$(git rev-list -n 1 "${current_tag}^{}")"
           previous_tag="$(git describe --tags --abbrev=0 "${current_tag}^{}^" 2>/dev/null || true)"
           api_base="${GITEA_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
 
           {
             echo "## Changes"
             echo
+            echo "Built from commit: \`${GITHUB_SHA}\`"
+            echo
             if [[ -n "${previous_tag}" ]]; then
               echo "Changes since \`${previous_tag}\`:"
               echo
@@ -56,7 +67,7 @@ jobs:
 
           body="$(python3 -c 'import json, pathlib; print(json.dumps(pathlib.Path("RELEASE_NOTES.md").read_text()))')"
           payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"%s","body":%s,"draft":false,"prerelease":false}' \
-            "${current_tag}" "${GITHUB_SHA}" "${current_tag}" "${body}")"
+            "${current_tag}" "${tag_target}" "${current_tag}" "${body}")"
 
           status="$(curl -sS -o release.json -w '%{http_code}' \
             -H "Authorization: token ${GITEA_TOKEN}" \
@@ -84,46 +95,81 @@ jobs:
 
   build-windows-x64:
     name: Build windows-x64
-    runs-on: windows-latest
+    runs-on: ubuntu-latest
     needs: prepare-release
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-      - name: Install Rust target
-        shell: pwsh
+      - name: Resolve release tag
+        shell: bash
         run: |
-          New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\.cargo" | Out-Null
-          @"
+          set -euo pipefail
+
+          if [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then
+            release_tag="${GITHUB_REF_NAME}"
+          else
+            release_tag="$(git describe --tags --abbrev=0)"
+          fi
+          echo "RELEASE_TAG=${release_tag}" >> "${GITHUB_ENV}"
+
+      - name: Install cross compile dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          mkdir -p "${HOME}/.cargo"
+          cat > "${HOME}/.cargo/config.toml" <<EOF
           [source.crates-io]
           replace-with = "mirror"
 
           [source.mirror]
-          registry = "$env:CARGO_REGISTRY"
-          "@ | Set-Content -Path "$env:USERPROFILE\.cargo\config.toml" -Encoding utf8
-          rustup target add x86_64-pc-windows-msvc
+          registry = "${CARGO_REGISTRY}"
+
+          [target.x86_64-pc-windows-gnu]
+          linker = "x86_64-w64-mingw32-gcc"
+          ar = "x86_64-w64-mingw32-ar"
+          EOF
+
+          if command -v sudo >/dev/null 2>&1; then
+            sudo apt-get update
+            sudo apt-get install -y --no-install-recommends mingw-w64 gcc-mingw-w64-x86-64
+          else
+            apt-get update
+            apt-get install -y --no-install-recommends mingw-w64 gcc-mingw-w64-x86-64
+          fi
+          rustup target add x86_64-pc-windows-gnu
 
       - name: Build release binary
-        shell: pwsh
+        shell: bash
         run: |
-          $tag = git describe --tags --exact-match
-          $version = $tag -replace '^v', ''
-          ./scripts/publish-binaries.ps1 -Version $version -Target win -Clean
+          set -euo pipefail
+
+          tag="${RELEASE_TAG}"
+          version="${tag#v}"
+          mkdir -p dist
+          cargo build --release --target x86_64-pc-windows-gnu
+          cp target/x86_64-pc-windows-gnu/release/cdxs.exe "dist/cdxs-${version}-windows-x64.exe"
 
       - name: Upload release asset
-        shell: pwsh
+        shell: bash
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          $tag = git describe --tags --exact-match
-          $release = Invoke-RestMethod `
-            -Headers @{ Authorization = "token $env:GITEA_TOKEN" } `
-            -Uri "$env:GITEA_SERVER_URL/api/v1/repos/$env:GITHUB_REPOSITORY/releases/tags/$tag"
-          $file = Get-ChildItem -Path dist -File | Select-Object -First 1
-          curl.exe -fsS -X POST `
-            -H "Authorization: token $env:GITEA_TOKEN" `
-            -F "attachment=@$($file.FullName)" `
-            "$env:GITEA_SERVER_URL/api/v1/repos/$env:GITHUB_REPOSITORY/releases/$($release.id)/assets?name=$($file.Name)"
+          set -euo pipefail
+
+          tag="${RELEASE_TAG}"
+          api_base="${GITEA_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          curl -sS -H "Authorization: token ${GITEA_TOKEN}" "${api_base}/releases/tags/${tag}" > release.json
+          release_id="$(python3 -c 'import json; print(json.load(open("release.json"))["id"])')"
+          file="$(find dist -maxdepth 1 -type f | head -n 1)"
+          name="$(basename "${file}")"
+          curl -fsS -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -F "attachment=@${file}" \
+            "${api_base}/releases/${release_id}/assets?name=${name}"
 
   build-linux-x64:
     name: Build linux-x64
@@ -132,13 +178,27 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve release tag
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then
+            release_tag="${GITHUB_REF_NAME}"
+          else
+            release_tag="$(git describe --tags --abbrev=0)"
+          fi
+          echo "RELEASE_TAG=${release_tag}" >> "${GITHUB_ENV}"
 
       - name: Build release binary
         shell: bash
         run: |
           set -euo pipefail
 
-          tag="$(git describe --tags --exact-match)"
+          tag="${RELEASE_TAG}"
           version="${tag#v}"
           target_name="linux-x64"
           rust_target="x86_64-unknown-linux-gnu"
@@ -169,7 +229,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          tag="$(git describe --tags --exact-match)"
+          tag="${RELEASE_TAG}"
           api_base="${GITEA_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
           curl -sS -H "Authorization: token ${GITEA_TOKEN}" "${api_base}/releases/tags/${tag}" > release.json
           release_id="$(python3 -c 'import json; print(json.load(open("release.json"))["id"])')"
@@ -187,13 +247,27 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve release tag
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then
+            release_tag="${GITHUB_REF_NAME}"
+          else
+            release_tag="$(git describe --tags --abbrev=0)"
+          fi
+          echo "RELEASE_TAG=${release_tag}" >> "${GITHUB_ENV}"
 
       - name: Build release binary
         shell: bash
         run: |
           set -euo pipefail
 
-          tag="$(git describe --tags --exact-match)"
+          tag="${RELEASE_TAG}"
           version="${tag#v}"
           target_name="linux-arm64"
           rust_target="aarch64-unknown-linux-gnu"
@@ -224,7 +298,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          tag="$(git describe --tags --exact-match)"
+          tag="${RELEASE_TAG}"
           api_base="${GITEA_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
           curl -sS -H "Authorization: token ${GITEA_TOKEN}" "${api_base}/releases/tags/${tag}" > release.json
           release_id="$(python3 -c 'import json; print(json.load(open("release.json"))["id"])')"