diff --git a/.travis.yml b/.travis.yml
index 92f1fee..92a8d39 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -43,7 +43,7 @@ deploy:
   - provider: releases
     api_key:
       secure: "ZnbuFXVEqc+VbcYYjyCLsRxBL2P6jUJSBqQ7S19fZfa7Od8pIxz/gJ9bQPWMVqeYtsgP/PD3VaqsUiMGIn+J174yMonQI3fR/XR6UpbGSs7YaFg2Fa7yfGt5NDgMhi0eZt+EqWA0yoin0JKO0BPMpsN2ik45zdy4rw/ATa+XES3PDS455nCR1K6pD/7FOP7h+H3hmVKFx+8fY6Ojy8lhYRDpnt9/91wb0pDlg5nnEJHVH1/TSvmiTUXFcq9SPehcKCkiQyC0+drY44Ex58/QG9uRf6vOxIsirJKqgnfAe8zjBCz2vZbO04DcygfJYku4tQj+MD2h12kDrQppn6TkRk768U5ktF31I30OU7/PW83dJ1hrE64MICB+yHf+w9gEzmKV4vdAAXaghjdTojIWd1dzNGmWY8K8RDhyJsuO9NO7NkGqA9vfAYODk0Oz9U0wTVBdcd1n/zSf5EjSM4Gg9YgIliTfcQiA3j8L332DZi7J6dC46RJHuZjQfemDrnBkF4vcAXYEVouzIhQHzVX/VE+CgIe/ayXMSOYcUju/1rhb2ktKoqV49pOaEZ3SGA76pkhHAGy4gnm2sadQDSp0SocQ4PTY4vLim7nXrQiuLMb722waz7KaBCSw1/MegDmXQ9sF1iZP2g1b7kUVwES+3Xjg/oer7jU2pDHLJyP8IHQ="
-    file: deployment/*
+    file: deployment/**/*
     file_glob: true
     skip_cleanup: true
     on:
diff --git a/README.md b/README.md
index 4b7122c..1e433db 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
  * Supports advanced use cases like multiple passwords/public keys, [key threshold schemes](https://en.wikipedia.org/wiki/Secret_sharing) and more.
  * Fast. ~1.1 Gb/s on a 2013 MacBook using AES256-GCM algorithm. Usually I/O bandwidth is the limiting factor.
  * Easy to use at both beginner and advanced level (see examples below).
- * Lightweight: ~1 Mb binary size; <10 Mb memory used (except as required by password derivation functions).
+ * Lightweight, single-binary distribution: ~1 Mb binary size; <10 Mb memory used (except as required by password derivation functions).
  * Operating System Support: x86 Linux, MacOS, Windows.
  * Open source, MIT license.
 
diff --git a/appveyor.yml b/appveyor.yml
index ca6ea59..ad3636d 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -41,8 +41,11 @@ before_deploy:
   - cargo rustc --target %TARGET% --release --bins -- -C lto
   - ps: ci\before_deploy.ps1
 
+artifacts:
+  - path: deployment\**\*.*
+
 deploy:
-  - artifact: /.*\.zip/
+  - artifact: /.*/
     auth_token:
       secure: qWDXszRXbGzhtHi9+Z4fRzRWpSW+XsK6IWXXPgTmgfSPSNRvEvPv+hHG57btbqMc
     description: ''
diff --git a/ci/before_deploy.ps1 b/ci/before_deploy.ps1
index 3d0cf12..cfd7f32 100755
--- a/ci/before_deploy.ps1
+++ b/ci/before_deploy.ps1
@@ -1,24 +1,19 @@
 # This script takes care of packaging the build artifacts that will go in the
 # release zipfile
 
-$SRC_DIR = $PWD.Path
-New-Item -Type Directory -Name deployment
+# Create target folder to put files in.
+$TARGET_DIR = ".\deployment\$($Env:FRIENDLY_TARGET_NAME)"
+New-Item -Type Directory -Path $TARGET_DIR
 
-Set-Location $ENV:Temp
-$STAGE = [System.Guid]::NewGuid().ToString()
-New-Item -Type Directory -Name $STAGE
-Set-Location $STAGE
+# Copy the binary file. This is the only actual file we're packaging.
+Copy-Item ".\target\$($Env:TARGET)\release\$($Env:PROJECT_NAME).exe" "$TARGET_DIR\"
 
-$ZIP = "$SRC_DIR\deployment\$($Env:PROJECT_NAME)-$($Env:APPVEYOR_REPO_TAG_NAME)-$($Env:FRIENDLY_TARGET_NAME).zip"
+Push-Location "$TARGET_DIR"
 
-# TODO Update this to package the right artifacts
-Copy-Item "$SRC_DIR\target\$($Env:TARGET)\release\$($Env:PROJECT_NAME).exe" '.\'
-Copy-Item "$SRC_DIR\README.md" '.\'
-Copy-Item "$SRC_DIR\LICENSE" '.\'
+# Create a basic SHASUM file
+(Get-ChildItem -File "." |
+        Get-FileHash -Algorithm SHA256 |
+        Format-Table -Property @{Name='Path';Expression={Resolve-Path -Relative $_.Path}},Hash -AutoSize -HideTableHeaders |
+        Out-String).Trim() | Out-File -Path "./SHA256SUM"
 
-7z a "$ZIP" *
-
-Push-AppveyorArtifact "$ZIP"
-
-Remove-Item *.* -Force
-Set-Location $SRC_DIR
+Pop-Location
\ No newline at end of file
diff --git a/ci/before_deploy.sh b/ci/before_deploy.sh
index 9d0b000..b9fe1fb 100755
--- a/ci/before_deploy.sh
+++ b/ci/before_deploy.sh
@@ -9,52 +9,30 @@
 # This requires skip_cleanup: true option.
 # Also current working directory for this whole script is the main repo directory.
 
-fill_tarball_contents() {
-  local STAGING_DIR="$1"
-
-  # Copy main binary to the staging directory and make it smaller
-  cp "target/$TARGET/release/$PROJECT_NAME" "$STAGING_DIR/"
-  local RYPT_BINARY="$STAGING_DIR/$PROJECT_NAME"
-  strip "$RYPT_BINARY"
-
-  # Sanity check that git tag corresponds to binary version
-  local VERSION=$("$RYPT_BINARY" --version | head -n 1)
-  if [[ "$VERSION" != "$PROJECT_NAME ${TRAVIS_TAG#v}" ]]; then
-    echo "Binary version \"$VERSION\" does not correspond to tag \"$TRAVIS_TAG\""
-    exit 1
-  fi
-
-  # Copy readme and license
-  cp {README.md,LICENSE} "$STAGING_DIR/"
-
-  # Print contents of the archive
-  ls -l "$STAGING_DIR/"
-}
-
-create_tarball() {
-  local DEPLOYMENT_DIR="$1"
-  local NAME="$2"
-
-  # Ensure we're not reusing deployment directory
-  rm -rf "$DEPLOYMENT_DIR"
-
-  # Create a staging directory to keep the future tarball contents
-  local STAGING_DIR="$DEPLOYMENT_DIR/$NAME"
-  mkdir -p "$STAGING_DIR"
-
-  fill_tarball_contents "$STAGING_DIR"
-
-  # Create the tarball in the deployment directory
-  (cd "$DEPLOYMENT_DIR" && tar czf "$NAME.tar.gz" "$NAME")
-  ls -l "$DEPLOYMENT_DIR/$NAME.tar.gz"
-
-  rm -rf "$STAGING_DIR"
-}
-
-# Name of the tarball and the folder inside the tarball
-NAME="$PROJECT_NAME-$TRAVIS_TAG-$FRIENDLY_TARGET_NAME"
-
-# Main folder to be used in deployment. This whole directory will be uploaded to GitHub releases.
+# Deployment base folder relative to main repo directory. All contents of this directory will be uploaded to GitHub releases.
 DEPLOYMENT_DIR="deployment"
-
-create_tarball "$DEPLOYMENT_DIR" "$NAME"
\ No newline at end of file
+rm -rf "$DEPLOYMENT_DIR"
+mkdir "$DEPLOYMENT_DIR"
+
+# Create a per-target directory where we'll put the actual files
+TARGET_DIR="$DEPLOYMENT_DIR/$FRIENDLY_TARGET_NAME"
+mkdir "$TARGET_DIR"
+
+# Copy main binary to the staging directory and make it smaller
+cp "target/$TARGET/release/$PROJECT_NAME" "$TARGET_DIR/"
+RYPT_BINARY="$TARGET_DIR/$PROJECT_NAME"
+strip "$RYPT_BINARY"
+
+# Sanity check that git tag corresponds to binary version
+VERSION=$("$RYPT_BINARY" --version | head -n 1)
+if [[ "$VERSION" != "$PROJECT_NAME ${TRAVIS_TAG#v}" ]]; then
+  echo "Error: Binary version \"$VERSION\" does not correspond to tag \"$TRAVIS_TAG\""
+  exit 1
+fi
+
+# Calculate SHA256 hash of the file(s) in the staging directory.
+(cd "$TARGET_DIR" && sha256sum -b -- * > SHA256SUMS)
+
+# Print contents of the archive and the sha sums
+ls -l "$TARGET_DIR/"
+cat "$TARGET_DIR/SHA256SUMS"