diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000000..841a2e640687
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,181 @@
+---
+# https://docs.corelightning.org/docs/release-checklist
+name: "Release 🚀"
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v[0-9]+.[0-9]+[0-9a-z]+'
+  workflow_dispatch:
+      create_release:
+        description: Create a draft release
+        default: no
+        type: choice
+        options:
+          - yes
+          - no
+
+jobs:
+  check:
+    name: Check
+    outputs:
+      version: ${{ steps.capture.outputs.version }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Git checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+
+      - name: Determine version from pushed tag
+        if: ${{ github.ref_type == 'tag' }}
+        run: echo "VERSION=${{ github.ref_name }}" >> "$GITHUB_ENV"
+
+      # Relevant for testing branches.
+      - name: Determine version from pushed branch tag
+        if: ${{ github.ref_type == 'branch' }}
+        run: echo "VERSION=$(git tag --points-at HEAD)" >> "$GITHUB_ENV"
+
+      - name: Validate release
+        run: tools/check-release.sh --version=${VERSION}
+
+      - name: Catpure version output
+        id: capture
+        run: echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+  releases:
+    name: Releases
+    needs: check
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false    # Let each build finish.
+      matrix:
+        target:
+          - 'bin-Fedora-28-amd64'
+          - 'bin-Ubuntu-focal'
+          - 'bin-Ubuntu-jammy'
+          - 'bin-Ubuntu-noble'
+    steps:
+      - name: Git checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+
+      # tools/build-release.sh requires lowdown
+      - name: Prepare base environment
+        run: |
+          sudo apt-get install -y lowdown
+          ./configure
+
+      - name: Build environment setup
+        run: |
+          distribution=$(echo ${{ matrix.target }} | cut -d'-' -f3)
+          echo "Building base image for ${distribution}"
+          sudo docker run --rm -v $(pwd):/build ubuntu:${distribution} bash -c "\
+              apt-get update && \
+              apt-get install -y debootstrap && \
+              debootstrap ${distribution} /build/${distribution}"
+          sudo tar -C ${distribution} -c . | docker import - ${distribution}
+
+          # Build Docker image
+          docker build -t cl-repro-${distribution} - < contrib/reprobuild/Dockerfile.${distribution}
+        if: contains(matrix.target, 'Ubuntu')
+
+      - name: Build release
+        run: tools/build-release.sh ${{ matrix.target }}
+
+      - name: Upload target artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          path: release/
+          name: ${{ matrix.target }}
+          if-no-files-found: error
+
+  artifact:
+    name: Construct release artifact
+    needs:
+      - check
+      - releases
+    env:
+      version: ${{ needs.check.outputs.version }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Merge artifacts
+        uses: actions/upload-artifact/merge@v4
+        with:
+          name: c-lightning-${{ env.version }}
+          pattern: bin-*
+          delete-merged: true
+
+  release:
+    name: Sign and prepare release draft
+    needs:
+      - check
+      - artifact
+    env:
+      version: ${{ needs.check.outputs.version }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Git checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: c-lightning-${{ env.version }}
+          path: release/
+
+      - name: Import GPG keys
+        id: gpg
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          trust_level: 5
+
+      - name: Set default GPG key
+        run: echo "default-key ${{ steps.gpg.outputs.keyid }}" >> ~/.gnupg/gpg.conf
+
+      - name: Sign release
+        run: |
+          sudo apt-get install -y lowdown
+          ./configure
+          tools/build-release.sh --without-zip sign
+          mv release/SHA256SUMS.asc${{ steps.gpg.outputs.keyid  }} release/SHA256SUMS.asc
+
+      - name: Upload signed artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: c-lightning-${{ env.version }}
+          overwrite: true
+          path: release/
+
+      - name: Determine release data
+        id: release_data
+        run: |
+          VERSION=${{ env.version }}
+          CHANGELOG_VERSION=${VERSION#v}
+          echo "CHANGELOG_VERSION=$CHANGELOG_VERSION"
+          echo "changelog_version=$CHANGELOG_VERSION" >> "$GITHUB_OUTPUT"
+
+          CHANGELOG_TITLE=$(grep "## \[${CHANGELOG_VERSION}\]" CHANGELOG.md)
+          echo "CHANGELOG_TITLE=$CHANGELOG_TITLE"
+          echo "changelog_title=$CHANGELOG_TITLE" >> "$GITHUB_OUTPUT"
+
+          RELEASE_TITLE=$(echo $CHANGELOG_TITLE | cut -d'"' -f2)
+          echo "RELEASE_TITLE=$RELEASE_TITLE"
+          echo "release_title=$RELEASE_TITLE" >> "$GITHUB_OUTPUT"
+
+      - name: Prepare release draft
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.create_release == 'yes')
+        uses: softprops/action-gh-release@v2
+        with:
+          name: "${{ env.version }} ${{ steps.release_data.outputs.release_title }}"
+          tag_name: ${{ env.version }}
+          draft: true
+          prerelease: contains(env.version, "-rc")
+          files: release/*
+          fail_on_unmatched_files: true
diff --git a/action.yml b/action.yml
deleted file mode 100644
index 034d68c8e852..000000000000
--- a/action.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-name: 'Lightning CI'
-description: 'A preconfigured container with all Core Lightning dependencies'
-runs:
-  using: 'docker'
-  image: 'contrib/Dockerfile.tester'
diff --git a/contrib/docker/Dockerfile.alpine b/contrib/docker/Dockerfile.alpine
deleted file mode 100644
index c1605c1de16c..000000000000
--- a/contrib/docker/Dockerfile.alpine
+++ /dev/null
@@ -1,54 +0,0 @@
-FROM alpine:3.16 as builder
-LABEL org.opencontainers.image.authors="Vincenzo Palazzo (@vincenzopalazzo) vincenzopalazzodev@gmail.com"
-
-WORKDIR /build
-
-RUN apk update && \
-    apk add \
-      alpine-sdk \
-      autoconf \
-      automake \
-      ca-certificates \
-      cargo \
-      gettext \
-      git \
-      libsodium \
-      libtool \
-      net-tools \
-      postgresql-dev \
-      linux-headers \
-      py3-pip \
-      python3 \
-      python3-dev \
-      sqlite-dev \
-      sqlite-static \
-      su-exec \
-      zlib-dev \
-      zlib-static
-
-COPY . /source
-
-RUN git clone /source /repo --recursive && \
-    cd /repo && \
-    python3 -m pip install poetry && \
-    poetry export --without-hashes --with=dev > requirements.txt && \
-    python3 -m pip install -r requirements.txt --ignore-installed --force && \
-    ./configure --enable-static --prefix=/usr && \
-    make -j $(nproc) && \
-    make install
-
-FROM alpine:3.16 as runner
-
-RUN apk update && \
-    apk add \
-      postgresql \
-      bitcoin-cli
-
-COPY --from=builder /usr/bin/lightningd /usr/bin/
-COPY --from=builder /usr/bin/lightning-cli /usr/bin/
-COPY --from=builder /usr/bin/lightning-hsmtool /usr/bin/
-COPY --from=builder /usr/libexec/c-lightning /usr/libexec/c-lightning
-COPY --from=builder /usr/share/man/man8 /usr/share/man/man8
-COPY --from=builder /usr/share/doc/c-lightning /usr/share/doc/c-lightning
-
-ENTRYPOINT ["/usr/bin/lightningd"]
diff --git a/contrib/docker/Dockerfile.builder b/contrib/docker/Dockerfile.builder
deleted file mode 100644
index 8c2e83e1f2d3..000000000000
--- a/contrib/docker/Dockerfile.builder
+++ /dev/null
@@ -1,69 +0,0 @@
-FROM ubuntu:16.04
-MAINTAINER Christian Decker <decker.christian@gmail.com>
-
-ENV DEBIAN_FRONTEND noninteractive
-ENV BITCOIN_VERSION 27.1
-
-WORKDIR /build
-
-RUN apt-get -qq update && \
-    apt-get -qq install --no-install-recommends --allow-unauthenticated -yy \
-	autoconf \
-	automake \
-	clang \
-	cppcheck \
-	docbook-xml \
-	shellcheck \
-	eatmydata \
-	software-properties-common \
-	build-essential \
-	autoconf \
-	locales \
-	libtool \
-	libprotobuf-c-dev \
-	libsqlite3-dev \
-	git \
-	python3 \
-	valgrind \
-	net-tools \
-	python3-mako \
-	python3-pip \
-	python3-setuptools \
-	python-pkg-resources \
-	shellcheck \
-	libxml2-utils \
-	lowdown \
-	wget \
-	jq \
-	gettext \
-	xsltproc \
-	zlib1g-dev && \
-	rm -rf /var/lib/apt/lists/*
-
-ENV LANGUAGE=en_US.UTF-8
-ENV LANG=en_US.UTF-8
-ENV LC_ALL=en_US.UTF-8
-RUN locale-gen en_US.UTF-8 && dpkg-reconfigure locales
-
-RUN cd /tmp/ && \
-    wget https://bitcoin.org/bin/bitcoin-core-$BITCOIN_VERSION/bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz -O bitcoin.tar.gz && \
-    tar -xvzf bitcoin.tar.gz && \
-    mv /tmp/bitcoin-$BITCOIN_VERSION/bin/bitcoin* /usr/local/bin/ && \
-    rm -rf bitcoin.tar.gz /tmp/bitcoin-$BITCOIN_VERSION
-
-RUN pip3 install --upgrade pip && \
-    python3 -m pip install \
-	CherryPy==17.3.0 \
-	Flask==1.0.2 \
-	cheroot==8.2.1 \
-	ephemeral-port-reserve==1.1.0 \
-	pytest-benchmark==3.1.1 \
-        pytest-forked==0.2 \
-	pytest-timeout==1.3.3 \
-	pytest-xdist==1.22.2 \
-	pytest==3.8.1 \
-	python-bitcoinlib==0.10.2 \
-	tqdm==4.26.0 \
-	pytest-test-groups==1.0.3 \
-	flake8==3.5.0 \
-	pytest-rerunfailures==3.1
diff --git a/contrib/docker/Dockerfile.tester b/contrib/docker/Dockerfile.tester
deleted file mode 100644
index 2b80d08745b7..000000000000
--- a/contrib/docker/Dockerfile.tester
+++ /dev/null
@@ -1,78 +0,0 @@
-FROM ubuntu:22.04
-LABEL mantainer="Christian Decker <decker.christian@gmail.com>"
-
-ENV DEBIAN_FRONTEND noninteractive
-ENV BITCOIN_VERSION 27.1
-ENV ELEMENTS_VERSION 23.2.1
-
-RUN useradd -ms /bin/bash tester
-RUN mkdir /build /bolts && chown tester -R /build /bolts
-WORKDIR /build
-
-RUN apt-get -qq update && \
-    apt-get -qq install --no-install-recommends --allow-unauthenticated -yy \
-	autoconf \
-	autoconf \
-	automake \
-	binfmt-support \
-	build-essential \
-	clang \
-	cppcheck \
-	docbook-xml \
-	eatmydata \
-	gcc-aarch64-linux-gnu \
-	gcc-arm-linux-gnueabihf \
-	gcc-arm-none-eabi \
-	gettext \
-	git \
-	libc6-dev-arm64-cross \
-	libc6-dev-armhf-cross \
-	libpq-dev \
-	libprotobuf-c-dev \
-	libsqlite3-dev \
-	libtool \
-	libxml2-utils \
-	locales \
-	net-tools \
-	postgresql-10 \
-	python-pkg-resources \
-	python3 \
-	python3-dev \
-	python3-pip \
-	python3-setuptools \
-	qemu \
-	qemu-system-arm \
-	qemu-user-static \
-	shellcheck \
-	software-properties-common \
-	sudo \
-	tcl \
-	unzip \
-	valgrind \
-	wget \
-	jq \
-	xsltproc \
-	zlib1g-dev && \
-	rm -rf /var/lib/apt/lists/*
-
-ENV LANGUAGE=en_US.UTF-8
-ENV LANG=en_US.UTF-8
-ENV LC_ALL=en_US.UTF-8
-RUN locale-gen en_US.UTF-8 && dpkg-reconfigure locales
-RUN echo "tester ALL=(root) NOPASSWD:ALL" > /etc/sudoers.d/tester && \
-    chmod 0440 /etc/sudoers.d/tester
-
-RUN cd /tmp/ && \
-    wget https://bitcoincore.org/bin/bitcoin-core-$BITCOIN_VERSION/bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz && \
-    wget https://github.com/ElementsProject/elements/releases/download/elements-$ELEMENTS_VERSION/elements-$ELEMENTS_VERSION-x86_64-linux-gnu.tar.gz && \
-    tar -xzf bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz && \
-    tar -xzf elements-$ELEMENTS_VERSION-x86_64-linux-gnu.tar.gz && \
-    mv bitcoin-$BITCOIN_VERSION/bin/* /usr/local/bin && \
-    mv elements-$ELEMENTS_VERSION/bin/* /usr/local/bin && \
-    rm -rf \
-       bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz \
-       bitcoin-$BITCOIN_VERSION \
-       elements-$ELEMENTS_VERSION-x86_64-linux-gnu.tar.gz \
-       elements-$ELEMENTS_VERSION
-
-USER tester
diff --git a/contrib/docker/Dockerfile.ubuntu b/contrib/docker/Dockerfile.ubuntu
deleted file mode 100644
index 401a60d1cb2d..000000000000
--- a/contrib/docker/Dockerfile.ubuntu
+++ /dev/null
@@ -1,40 +0,0 @@
-FROM ubuntu:22.04
-LABEL mantainer="Vincenzo Palazzo vincenzopalazzodev@gmail.com"
-
-WORKDIR /work
-
-ENV DEBIAN_FRONTEND=noninteractive
-ENV LANGUAGE=en_US.UTF-8
-ENV LANG=en_US.UTF-8
-ENV LC_ALL=en_US.UTF-8
-ENV TZ="Europe/London"
-
-RUN apt-get -qq update && \
-    apt-get -qq install --no-install-recommends --allow-unauthenticated -yy \
-    sudo \
-    locales \
-    tzdata
-
-RUN ln -fs /usr/share/zoneinfo/America/New_York /etc/localtime
-
-RUN locale-gen en_US.UTF-8 && dpkg-reconfigure --frontend noninteractive tzdata
-
-# install package for python cryptography lib
-# https://cryptography.io/en/latest/installation/#debian-ubuntu
-
-RUN apt-get -qq update && \
-    apt-get -qq install --no-install-recommends --allow-unauthenticated -yy \
-    jq build-essential libssl-dev libffi-dev \
-    python3-dev cargo python3-pip
-
-COPY . .
-
-RUN pip install poetry && \
-    poetry export --without-hashes -o /tmp/requirements.txt && \
-    cat /tmp/requirements.txt && \
-    pip install -r /tmp/requirements.txt
-
-# move the script in the root of the directory
-RUN cp contrib/docker/scripts/*.sh .
-
-CMD ["./contrib/docker/scripts/entrypoint.sh"]
diff --git a/contrib/docker/scripts/build.sh b/contrib/docker/scripts/build.sh
deleted file mode 100755
index b59efffa082d..000000000000
--- a/contrib/docker/scripts/build.sh
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/bin/bash
-
-echo "Running in $(pwd)"
-export ARCH=${ARCH:-64}
-export BOLTDIR=bolts
-export CC=${COMPILER:-gcc}
-export COMPAT=${COMPAT:-1}
-export TEST_CHECK_DBSTMTS=${TEST_CHECK_DBSTMTS:-0}
-export PATH=$CWD/dependencies/bin:"$HOME"/.local/bin:"$PATH"
-export PYTEST_OPTS="--maxfail=5 --suppress-no-test-exit-code ${PYTEST_OPTS}"
-export PYTEST_PAR=${PYTEST_PAR:-10}
-export PYTEST_SENTRY_ALWAYS_REPORT=1
-export SLOW_MACHINE=1
-export TEST_CMD=${TEST_CMD:-"make -j $PYTEST_PAR pytest"}
-export TEST_DB_PROVIDER=${TEST_DB_PROVIDER:-"sqlite3"}
-export TEST_NETWORK=${NETWORK:-"regtest"}
-export TIMEOUT=900
-export VALGRIND=${VALGRIND:-0}
-export FUZZING=${FUZZING:-0}
-export LIGHTNINGD_POSTGRES_NO_VACUUM=1
-export GENERATE_EXAMPLES=${GENERATE_EXAMPLES:-0}
-
-pip3 install --upgrade pip
-pip3 install --user poetry
-poetry export --dev --without-hashes -o requirements.txt
-pip3 install -r requirements.txt
-
-git clone https://github.com/lightning/bolts.git ../bolts
-git submodule update --init --recursive
-
-./configure CC="$CC"
-cat config.vars
-
-cat << EOF > pytest.ini
-[pytest]
-addopts=-p no:logging --color=yes --timeout=1800 --timeout-method=thread --test-group-random-seed=42
-markers =
-    slow_test: marks tests as slow (deselect with '-m "not slow_test"')
-EOF
-
-if [ "$TARGET_HOST" == "arm-linux-gnueabihf" ] || [ "$TARGET_HOST" == "aarch64-linux-gnu" ]
-then
-    export QEMU_LD_PREFIX=/usr/"$TARGET_HOST"/
-    export MAKE_HOST="$TARGET_HOST"
-    export BUILD=x86_64-pc-linux-gnu
-    export AR="$TARGET_HOST"-ar
-    export AS="$TARGET_HOST"-as
-    export CC="$TARGET_HOST"-gcc
-    export CXX="$TARGET_HOST"-g++
-    export LD="$TARGET_HOST"-ld
-    export STRIP="$TARGET_HOST"-strip
-    export CONFIGURATION_WRAPPER=qemu-"${TARGET_HOST%%-*}"-static
-
-    wget -q https://zlib.net/fossils/zlib-1.2.13.tar.gz
-    tar xf zlib-1.2.13.tar.gz
-    cd zlib-1.2.13 || exit 1
-    ./configure --prefix="$QEMU_LD_PREFIX"
-    make
-    sudo make install
-    cd .. || exit 1
-    rm zlib-1.2.13.tar.gz && rm -rf zlib-1.2.13
-
-    wget -q https://www.sqlite.org/2018/sqlite-src-3260000.zip
-    unzip -q sqlite-src-3260000.zip
-    cd sqlite-src-3260000 || exit 1
-    automake --add-missing --force-missing --copy || true
-    ./configure --disable-tcl \
-     --enable-static \
-     --disable-readline \
-     --disable-threadsafe \
-     --disable-load-extension \
-     --host="$TARGET_HOST" \
-     --prefix="$QEMU_LD_PREFIX"
-    make
-    sudo make install
-    cd .. || exit 1
-    rm sqlite-src-3260000.zip
-    rm -rf sqlite-src-3260000
-
-    ./configure CC="$TARGET_HOST-gcc" --enable-static
-
-    make -j32 CC="$TARGET_HOST-gcc" > /dev/null
-else
-    eatmydata make -j32
-    # shellcheck disable=SC2086
-    eatmydata $TEST_CMD
-fi
diff --git a/contrib/docker/scripts/entrypoint.sh b/contrib/docker/scripts/entrypoint.sh
deleted file mode 100755
index 28e4f5bc2388..000000000000
--- a/contrib/docker/scripts/entrypoint.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/bash
-./setup.sh
-./build.sh
diff --git a/contrib/docker/scripts/setup.sh b/contrib/docker/scripts/setup.sh
deleted file mode 100755
index a05e02fe7653..000000000000
--- a/contrib/docker/scripts/setup.sh
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/bin/bash
-
-export DEBIAN_FRONTEND=noninteractive
-export BITCOIN_VERSION=27.1
-export ELEMENTS_VERSION=23.2.1
-export RUST_VERSION=nightly
-export TZ="Europe/London"
-
-sudo apt-get update -qq
-
-sudo apt-get -qq install --no-install-recommends --allow-unauthenticated -yy \
-     autoconf \
-     automake \
-     binfmt-support \
-     build-essential \
-     clang \
-     cppcheck \
-     docbook-xml \
-     eatmydata \
-     gcc-aarch64-linux-gnu \
-     gcc-arm-linux-gnueabihf \
-     gcc-arm-none-eabi \
-     gettext \
-     git \
-     libc6-dev-arm64-cross \
-     libc6-dev-armhf-cross \
-     libpq-dev \
-     libprotobuf-c-dev \
-     libsqlite3-dev \
-     libtool \
-     libxml2-utils \
-     locales \
-     net-tools \
-     postgresql \
-     python-pkg-resources \
-     python3 \
-     python3-dev \
-     python3-pip \
-     python3-setuptools \
-     qemu \
-     qemu-system-arm \
-     qemu-user-static \
-     shellcheck \
-     software-properties-common \
-     sudo \
-     tcl \
-     unzip \
-     valgrind \
-     wget \
-     jq \
-     xsltproc \
-     zlib1g-dev
-
-(
-    cd /tmp/ || exit 1
-    wget https://bitcoincore.org/bin/bitcoin-core-$BITCOIN_VERSION/bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz
-    wget https://github.com/ElementsProject/elements/releases/download/elements-$ELEMENTS_VERSION/elements-$ELEMENTS_VERSION-x86_64-linux-gnu.tar.gz
-    tar -xzf bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz
-    tar -xzf elements-$ELEMENTS_VERSION-x86_64-linux-gnu.tar.gz
-    sudo mv bitcoin-$BITCOIN_VERSION/bin/* /usr/local/bin
-    sudo mv elements-$ELEMENTS_VERSION/bin/* /usr/local/bin
-    rm -rf \
-       bitcoin-$BITCOIN_VERSION-x86_64-linux-gnu.tar.gz \
-       bitcoin-$BITCOIN_VERSION \
-       elements-$ELEMENTS_VERSION-x86_64-linux-gnu.tar.gz \
-       elements-$ELEMENTS_VERSION
-)
-
-if [ "$RUST" == "1" ]; then
-    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- \
-      -y --default-toolchain ${RUST_VERSION}
-fi
diff --git a/doc/contribute-to-core-lightning/release-checklist.md b/doc/contribute-to-core-lightning/release-checklist.md
index 5cbbccf5ca39..6cf9dd8e40cf 100644
--- a/doc/contribute-to-core-lightning/release-checklist.md
+++ b/doc/contribute-to-core-lightning/release-checklist.md
@@ -32,11 +32,10 @@ Here's a checklist for the release process.
 1. Merge the above PR.
 2. Tag it `git pull && git tag -s v<VERSION>rc1`. Note that you should get a prompt to give this tag a 'message'. Make sure you fill this in.
 3. Confirm that the tag will show up for builds with `git describe`
-4. Push the tag to remote `git push --tags`.
-5. Draft a new `v<VERSION>rc1` release on Github and check `Set as a pre-release` option.
-6. Run the script `contrib/cl-repro.sh` for [Builder image setup](https://docs.corelightning.org/docs/repro#builder-image-setup). This will create the required builder images `cl-repro-<codename>` for the next step.
-7. Run `tools/build-release.sh bin-Fedora-28-amd64 bin-Ubuntu sign` script to prepare required builds for the release. With `bin-Fedora-28-amd64 bin-Ubuntu sign`, it will build a zipfile, a non-reproducible Fedora, reproducible Ubuntu images. Once it is done, the script will sign the release contents and create SHA256SUMS and SHA256SUMS.asc in the release folder.
-8. Upload reproducible builds, SHA256SUMS and SHA256SUMS.asc from the release folder to newly drafted release.
+4. Push the tag to remote `git push --tags` (pushing the tag will kickoff the "Release 🚀" CI action which builds the release targets and a draft release).
+7. Run the script `contrib/cl-repro.sh` for [Builder image setup](https://docs.corelightning.org/docs/repro#builder-image-setup). This will create the required builder images `cl-repro-<codename>` for the next step.
+8. Sign the release locally by running `tools/build-release.sh --without-zip sign` which will sign the release contents and create SHA256SUMS and SHA256SUMS.asc in the release folder.  Compare these with `c-lightning-<release tag>`.zip on GitHub.
+9. Check the generated draft `v<VERSION>rc1` release on Github and check `Set as a pre-release` option.  Add the SHA256SUMS.asc from your local release folder to newly drafted release, replacing it.
 9. Announce rc1 release on core-lightning's release-chat channel on Discord & [BuildOnL2](https://community.corelightning.org/c/general-questions/).
 10. Use `devtools/credit --verbose v<PREVIOUS-VERSION>` to get commits, days and contributors data for release note.
 11. Prepare release notes draft including information from above step, and share with the team for editing.
diff --git a/tools/build-release.sh b/tools/build-release.sh
index 610061ed6371..cb9da6d97947 100755
--- a/tools/build-release.sh
+++ b/tools/build-release.sh
@@ -20,6 +20,7 @@ fi
 
 FORCE_UNCLEAN=false
 VERIFY_RELEASE=false
+WITHOUT_ZIP=false
 
 ALL_TARGETS="bin-Fedora-28-amd64 bin-Ubuntu docker sign"
 # ALL_TARGETS="bin-Fedora-28-amd64 bin-Ubuntu tarball deb docker sign"
@@ -38,6 +39,9 @@ for arg; do
     --verify)
         VERIFY_RELEASE=true
         ;;
+    --without-zip)
+        WITHOUT_ZIP=true
+        ;;
     --help)
         echo "Usage: [--force-version=<ver>] [--force-unclean] [--force-mtime=YYYY-MM-DD] [--verify] [TARGETS]"
         echo Known targets: "$ALL_TARGETS"
@@ -113,32 +117,35 @@ echo "Release Directory: $RELEASEDIR"
 echo "Tarball File: $TARBALL"
 echo "Current Timestamp: $DATE"
 
-# submodcheck needs to know if we have lowdown
-./configure --reconfigure
-# If it's a completely clean directory, we need submodules!
-make submodcheck
 mkdir -p "$RELEASEDIR"
 
-echo "Creating Zip File"
-# delete zipfile if exists
-[ -f "$RELEASEDIR/clightning-$VERSION.zip" ] && rm "$RELEASEDIR/clightning-$VERSION.zip"
-mkdir "$RELEASEDIR/clightning-$VERSION"
-# git archive won't go into submodules :(; We use tar to copy
-git ls-files -z --recurse-submodules | tar --null --files-from=- -c -f - | (cd "$RELEASEDIR/clightning-$VERSION" && tar xf -)
-# tar can set dates on files, but zip cares about dates in directories!
-# We set to local time (not "$MTIME 00:00Z") because zip uses local time!
-find "$RELEASEDIR/clightning-$VERSION" -print0 | xargs -0r touch --no-dereference --date="$MTIME"
-# Seriously, we can have differing permissions, too.  Normalize.
-# Directories become drwxr-xr-x
-find "$RELEASEDIR/clightning-$VERSION" -type d -print0 | xargs -0r chmod 755
-# Executables become -rwxr-xr-x
-find "$RELEASEDIR/clightning-$VERSION" -type f -perm -100 -print0 | xargs -0r chmod 755
-# Non-executables become -rw-r--r--
-find "$RELEASEDIR/clightning-$VERSION" -type f ! -perm -100 -print0 | xargs -0r chmod 644
-# zip -r doesn't have a deterministic order, and git ls-files does.
-LANG=C git ls-files --recurse-submodules | sed "s@^@clightning-$VERSION/@" | (cd release && zip -@ -X "clightning-$VERSION.zip")
-rm -r "$RELEASEDIR/clightning-$VERSION"
-echo "Zip File Created"
+if [ "$WITHOUT_ZIP" = "false" ]; then
+    # submodcheck needs to know if we have lowdown
+    ./configure --reconfigure
+    # If it's a completely clean directory, we need submodules!
+    make submodcheck
+
+    echo "Creating Zip File"
+    # delete zipfile if exists
+    [ -f "$RELEASEDIR/clightning-$VERSION.zip" ] && rm "$RELEASEDIR/clightning-$VERSION.zip"
+    mkdir "$RELEASEDIR/clightning-$VERSION"
+    # git archive won't go into submodules :(; We use tar to copy
+    git ls-files -z --recurse-submodules | tar --null --files-from=- -c -f - | (cd "$RELEASEDIR/clightning-$VERSION" && tar xf -)
+    # tar can set dates on files, but zip cares about dates in directories!
+    # We set to local time (not "$MTIME 00:00Z") because zip uses local time!
+    find "$RELEASEDIR/clightning-$VERSION" -print0 | xargs -0r touch --no-dereference --date="$MTIME"
+    # Seriously, we can have differing permissions, too.  Normalize.
+    # Directories become drwxr-xr-x
+    find "$RELEASEDIR/clightning-$VERSION" -type d -print0 | xargs -0r chmod 755
+    # Executables become -rwxr-xr-x
+    find "$RELEASEDIR/clightning-$VERSION" -type f -perm -100 -print0 | xargs -0r chmod 755
+    # Non-executables become -rw-r--r--
+    find "$RELEASEDIR/clightning-$VERSION" -type f ! -perm -100 -print0 | xargs -0r chmod 644
+    # zip -r doesn't have a deterministic order, and git ls-files does.
+    LANG=C git ls-files --recurse-submodules | sed "s@^@clightning-$VERSION/@" | (cd release && zip -@ -X "clightning-$VERSION.zip")
+    rm -r "$RELEASEDIR/clightning-$VERSION"
+    echo "Zip File Created"
+fi
 
 for target in $TARGETS; do
     platform=${target#bin-}
@@ -153,12 +160,14 @@ for target in $TARGETS; do
         docker run --rm=true -w /build $TAG rm -rf /"$VERSION-$platform" /build
         echo "Fedora Image Built"
         ;;
-    Ubuntu)
-		for d in focal jammy noble; do
+    Ubuntu*)
+        distributions=${platform#Ubuntu-}
+        [ "$distributions" = "Ubuntu" ] && distributions="focal jammy noble"
+		for d in $distributions; do
             # Capitalize the first letter of distro
             D=$(echo "$d" | awk '{print toupper(substr($0,1,1))substr($0,2)}')
 			echo "Building Ubuntu $D Image"
-			docker run --rm -v "$(pwd)":/repo -e FORCE_MTIME="$MTIME" -e FORCE_VERSION="$VERSION" -ti cl-repro-"$d"
+			docker run --rm -v "$(pwd)":/repo -e FORCE_MTIME="$MTIME" -e FORCE_VERSION="$VERSION" cl-repro-"$d"
             echo "Ubuntu $D Image Built"
 		done
         ;;
diff --git a/tools/check-release.sh b/tools/check-release.sh
new file mode 100755
index 000000000000..90da958a57e2
--- /dev/null
+++ b/tools/check-release.sh
@@ -0,0 +1,74 @@
+#! /bin/bash
+
+set -e
+
+# Checks a version tag and performs validation, to catch common release
+#  tagging issues prior to build via Github Actions.
+#
+# 1. The version tag should point to the HEAD of the branch.
+#     - tools/build-release.sh#67
+# 2. The pushed tag should match the branch tag at the HEAD.
+# 3. The CHANGELOG.md contains a header entry for the version tag.
+# 4. The CHANGELOG.md entry for that version tag can be parsed for a date.
+
+for arg; do
+    case "$arg" in
+    --version=*)
+	    VERSION=${arg#*=}
+        ;;
+	--help)
+	    echo "Usage: [--version=<ver>]"
+	    exit 0
+	    ;;
+	*)
+	    echo "Unknown arg $arg" >&2
+	    exit 1
+	    ;;
+    esac
+    shift
+done
+
+echo "VERSION: ${VERSION}"
+
+# Version is required.
+if [ "$VERSION" = "" ]; then
+    echo "The --version argument is required."
+    exit 1
+fi
+
+# A tag should point to the HEAD of the branch.
+HEAD_VERSION=$(git tag --points-at HEAD)
+if [ "$HEAD_VERSION" = "" ]; then
+    echo "No tagged version at HEAD?" >&2
+    exit 1
+fi
+
+# The version tag should match the branch tag at the HEAD.
+if [ "$HEAD_VERSION" != "$VERSION" ]; then
+    echo "The HEAD tag must match the version tag." >&2
+    exit 1
+fi
+
+# The version tag should match the `make version` target output.
+MAKE_VERSION=$(make version)
+echo "MAKE_VERSION=$MAKE_VERSION"
+if [ "$MAKE_VERSION" != "$VERSION" ]; then
+    echo "The version tag must match the \`make version\` target output." >&2
+    exit 1
+fi
+
+# The CHANGELOG.md contains a header entry for the version tag.
+CHANGELOG_TITLE=$(grep "## \[${VERSION#v}\]" CHANGELOG.md)
+if [ "$CHANGELOG_TITLE" = "" ]; then
+    echo "No entry in the CHANGELOG.md found for $VERSION." >&2
+    exit 1
+fi
+echo "CHANGELOG_TITLE=$CHANGELOG_TITLE"
+
+# The CHANGELOG.md entry for that version tag can be parsed for a date.
+RELEASE_DATE=$(sed -n "s/^## \\[.*${VERSION#v}\\] - \\([-0-9]*\\).*/\\1/p" < CHANGELOG.md)
+echo "RELEASE_DATE=$RELEASE_DATE"
+if [ "$RELEASE_DATE" = "" ]; then
+    echo "The release title in CHANGELOG.md cannot be parsed for a date." >&2
+    exit 1
+fi
diff --git a/tools/repro-build.sh b/tools/repro-build.sh
index 6c346616c623..3a0b3c752276 100755
--- a/tools/repro-build.sh
+++ b/tools/repro-build.sh
@@ -53,6 +53,7 @@ else
     VER=$(uname -r)
 fi
 
+ARCH=$(dpkg --print-architecture)
 PLATFORM="$OS"-"$VER"
 VERSION=${FORCE_VERSION:-$(git describe --tags --always --dirty=-modded --abbrev=7 2>/dev/null || pwd | sed -n 's,.*/clightning-\(v[0-9.rc\-]*\)$,\1,p')}
 
@@ -164,4 +165,4 @@ make install DESTDIR=inst/
 
 cd inst && tar --sort=name \
       --mtime="$MTIME 00:00Z" \
-      --owner=0 --group=0 --numeric-owner -cvaf ../clightning-"$VERSION-$PLATFORM".tar.xz .
+      --owner=0 --group=0 --numeric-owner -cvaf ../clightning-"$VERSION-$PLATFORM-$ARCH".tar.xz .