diff --git a/.github/goreleaser.yml b/.github/goreleaser.yml
new file mode 100644
index 000000000..ebeec1d19
--- /dev/null
+++ b/.github/goreleaser.yml
@@ -0,0 +1,106 @@
+version: 2
+
+env:
+  - CGO_ENABLED=0
+
+builds:
+  - id: minio
+    main: .
+    binary: minio
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    goamd64:
+      - v1
+    flags:
+      - -tags=kqueue
+      - -trimpath
+    ldflags:
+      - "{{ .Env.LDFLAGS }}"
+
+archives:
+  - id: minio
+    ids:
+      - minio
+    name_template: "minio_{{ .Env.PKG_VERSION }}_{{ .Os }}_{{ .Arch }}"
+
+dockers:
+  - id: minio-amd64
+    ids:
+      - minio
+    goos: linux
+    goarch: amd64
+    dockerfile: Dockerfile.goreleaser
+    use: buildx
+    image_templates:
+      - "pgsty/minio:{{ .Tag }}-amd64"
+      - "pgsty/minio:latest-amd64"
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--label=org.opencontainers.image.version={{ .Tag }}"
+      - "--label=org.opencontainers.image.created={{ .Date }}"
+      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
+    extra_files:
+      - dockerscripts/docker-entrypoint.sh
+      - LICENSE
+      - CREDITS
+
+  - id: minio-arm64
+    ids:
+      - minio
+    goos: linux
+    goarch: arm64
+    dockerfile: Dockerfile.goreleaser
+    use: buildx
+    image_templates:
+      - "pgsty/minio:{{ .Tag }}-arm64"
+      - "pgsty/minio:latest-arm64"
+    build_flag_templates:
+      - "--platform=linux/arm64"
+      - "--label=org.opencontainers.image.version={{ .Tag }}"
+      - "--label=org.opencontainers.image.created={{ .Date }}"
+      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
+    extra_files:
+      - dockerscripts/docker-entrypoint.sh
+      - LICENSE
+      - CREDITS
+
+docker_manifests:
+  - name_template: "pgsty/minio:{{ .Tag }}"
+    image_templates:
+      - "pgsty/minio:{{ .Tag }}-amd64"
+      - "pgsty/minio:{{ .Tag }}-arm64"
+  - name_template: "pgsty/minio:latest"
+    image_templates:
+      - "pgsty/minio:latest-amd64"
+      - "pgsty/minio:latest-arm64"
+
+checksum:
+  name_template: "minio_{{ .Env.PKG_VERSION }}_checksums.txt"
+  algorithm: sha256
+
+release:
+  github:
+    owner: pgsty
+    name: minio
+  draft: false
+  prerelease: false
+  mode: replace
+  replace_existing_artifacts: true
+  name_template: "{{ .Tag }}"
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "Merge pull request"
+      - "Merge branch"
+
+announce:
+  skip: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..cd6c5eea6
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,136 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "RELEASE.*"
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Compute release variables
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME}"
+          VERSION_HYPHEN="${TAG#RELEASE.}"
+          PKG_VERSION="$(echo "${VERSION_HYPHEN}" | sed -E 's/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/\1\2\3\4\5\6.0.0/')"
+          if [ "${PKG_VERSION}" = "${VERSION_HYPHEN}" ]; then
+            echo "Invalid release tag format: ${TAG}"
+            exit 1
+          fi
+          VERSION_COLON="$(echo "${VERSION_HYPHEN}" | sed -E 's/T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/T\1:\2:\3Z/')"
+          LDFLAGS="$(MINIO_RELEASE=RELEASE go run buildscripts/gen-ldflags.go "${VERSION_COLON}")"
+
+          {
+            echo "RELEASE_TAG=${TAG}"
+            echo "PKG_VERSION=${PKG_VERSION}"
+            echo "LDFLAGS=${LDFLAGS}"
+          } >> "${GITHUB_ENV}"
+
+          echo "Release tag: ${TAG}"
+          echo "Package version: ${PKG_VERSION}"
+          echo "LDFLAGS: ${LDFLAGS}"
+
+      - name: Validate Docker Hub credentials
+        run: |
+          set -euo pipefail
+          if [ -z "${{ secrets.DOCKERHUB_USERNAME }}" ] || [ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
+            echo "Missing Docker Hub credentials. Set DOCKERHUB_USERNAME and DOCKERHUB_TOKEN repository secrets."
+            exit 1
+          fi
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and publish with GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: release --clean --skip=validate --config .github/goreleaser.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          LDFLAGS: ${{ env.LDFLAGS }}
+          PKG_VERSION: ${{ env.PKG_VERSION }}
+
+      - name: Install pkger
+        run: |
+          go install github.com/minio/pkger/v2@v2.6.18
+          echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
+
+      - name: Prepare package layout
+        run: |
+          set -euo pipefail
+          copy_binary() {
+            local arch="$1"
+            local pattern="$2"
+            local src
+            src="$(find dist -maxdepth 2 -type f -path "dist/${pattern}/minio" | head -n1 || true)"
+            if [ -z "${src}" ]; then
+              echo "Missing GoReleaser binary for ${arch} (${pattern})"
+              exit 1
+            fi
+            mkdir -p "dist/linux-${arch}"
+            cp "${src}" "dist/linux-${arch}/minio.${RELEASE_TAG}"
+          }
+
+          copy_binary amd64 "minio_linux_amd64*"
+          copy_binary arm64 "minio_linux_arm64*"
+
+      - name: Build standard pkger packages
+        run: |
+          set -euo pipefail
+          pkger -r "${RELEASE_TAG}" --appName minio --releaseDir dist --ignore
+
+          # Keep only full package files; drop convenience symlinks (minio.rpm/minio.deb/minio.apk)
+          find dist/linux-* -maxdepth 1 -type l \
+            \( -name 'minio.rpm' -o -name 'minio.deb' -o -name 'minio.apk' \) -delete
+
+          find dist -maxdepth 2 -type f \
+            \( -name '*.rpm' -o -name '*.deb' -o -name '*.apk' -o -name '*.sha256sum' -o -name 'downloads-minio.json' \) | sort
+
+      - name: Upload pkger artifacts to GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          mapfile -t files < <(find dist -maxdepth 2 -type f \
+            \( -name '*.rpm' -o -name '*.deb' -o -name '*.apk' -o -name '*.sha256sum' -o -name 'downloads-minio.json' \) | sort)
+          if [ "${#files[@]}" -eq 0 ]; then
+            echo "No packages were generated."
+            exit 1
+          fi
+          gh release upload "${RELEASE_TAG}" "${files[@]}" --clobber
+
+      - name: Upload dist artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
diff --git a/.github/workflows/test-release.yml b/.github/workflows/test-release.yml
new file mode 100644
index 000000000..fcc6aa101
--- /dev/null
+++ b/.github/workflows/test-release.yml
@@ -0,0 +1,89 @@
+name: Test Release Pipeline
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/goreleaser.yml"
+      - "Dockerfile.goreleaser"
+      - "minio.service"
+      - ".github/workflows/release.yml"
+      - ".github/workflows/test-release.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Compute test variables
+        run: |
+          set -euo pipefail
+          RELEASE_TAG="RELEASE.2026-02-14T12-00-00Z"
+          VERSION_COLON="2026-02-14T12:00:00Z"
+          PKG_VERSION="20260214120000.0.0"
+          LDFLAGS="$(MINIO_RELEASE=RELEASE go run buildscripts/gen-ldflags.go "${VERSION_COLON}")"
+          echo "RELEASE_TAG=${RELEASE_TAG}" >> "${GITHUB_ENV}"
+          echo "PKG_VERSION=${PKG_VERSION}" >> "${GITHUB_ENV}"
+          echo "LDFLAGS=${LDFLAGS}" >> "${GITHUB_ENV}"
+          echo "PKG_VERSION: ${PKG_VERSION}"
+          echo "LDFLAGS: ${LDFLAGS}"
+
+      - name: GoReleaser config check
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: check --config .github/goreleaser.yml
+
+      - name: Build snapshot artifacts
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: release --snapshot --clean --skip=publish,docker --config .github/goreleaser.yml
+        env:
+          LDFLAGS: ${{ env.LDFLAGS }}
+          PKG_VERSION: ${{ env.PKG_VERSION }}
+
+      - name: Install pkger
+        run: |
+          go install github.com/minio/pkger/v2@v2.6.18
+          echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"
+
+      - name: Package snapshot binaries with pkger
+        run: |
+          set -euo pipefail
+          copy_binary() {
+            local arch="$1"
+            local pattern="$2"
+            local src
+            src="$(find dist -maxdepth 2 -type f -path "dist/${pattern}/minio" | head -n1 || true)"
+            if [ -z "${src}" ]; then
+              echo "Missing GoReleaser binary for ${arch} (${pattern})"
+              exit 1
+            fi
+            mkdir -p "dist/linux-${arch}"
+            cp "${src}" "dist/linux-${arch}/minio.${RELEASE_TAG}"
+          }
+
+          copy_binary amd64 "minio_linux_amd64*"
+          copy_binary arm64 "minio_linux_arm64*"
+          pkger -r "${RELEASE_TAG}" --appName minio --releaseDir dist --ignore
+
+          # Keep only full package files; drop convenience symlinks (minio.rpm/minio.deb/minio.apk)
+          find dist/linux-* -maxdepth 1 -type l \
+            \( -name 'minio.rpm' -o -name 'minio.deb' -o -name 'minio.apk' \) -delete
+
+          find dist -maxdepth 2 -type f \
+            \( -name '*.rpm' -o -name '*.deb' -o -name '*.apk' -o -name '*.sha256sum' -o -name 'downloads-minio.json' \) | sort
diff --git a/Dockerfile.goreleaser b/Dockerfile.goreleaser
new file mode 100644
index 000000000..4273b1189
--- /dev/null
+++ b/Dockerfile.goreleaser
@@ -0,0 +1,34 @@
+FROM registry.access.redhat.com/ubi9/ubi:latest AS certs
+RUN dnf -y install ca-certificates && \
+    update-ca-trust && \
+    cp /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /tmp/ca-certificates.crt && \
+    dnf clean all && \
+    rm -rf /var/cache/dnf
+
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest
+
+LABEL maintainer="pgsty <https://github.com/pgsty/minio>" \
+      description="MinIO community fork, build by pgsty"
+
+ENV MINIO_ACCESS_KEY_FILE=access_key \
+    MINIO_SECRET_KEY_FILE=secret_key \
+    MINIO_ROOT_USER_FILE=access_key \
+    MINIO_ROOT_PASSWORD_FILE=secret_key \
+    MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
+    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
+    MINIO_CONFIG_ENV_FILE=config.env \
+    MC_CONFIG_DIR=/tmp/.mc
+
+COPY --from=certs /tmp/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY minio /usr/bin/minio
+COPY dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh
+COPY LICENSE /licenses/LICENSE
+COPY CREDITS /licenses/CREDITS
+
+RUN chmod +x /usr/bin/minio /usr/bin/docker-entrypoint.sh
+
+EXPOSE 9000
+VOLUME ["/data"]
+
+ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
+CMD ["minio"]
diff --git a/minio.service b/minio.service
new file mode 100644
index 000000000..34f8ca662
--- /dev/null
+++ b/minio.service
@@ -0,0 +1,43 @@
+[Unit]
+Description=MinIO
+Documentation=https://docs.min.io
+Wants=network-online.target
+After=network-online.target
+AssertFileIsExecutable=/usr/local/bin/minio
+
+[Service]
+Type=notify
+
+WorkingDirectory=/usr/local
+
+User=minio-user
+Group=minio-user
+ProtectProc=invisible
+
+EnvironmentFile=-/etc/default/minio
+ExecStart=/usr/local/bin/minio server $MINIO_OPTS $MINIO_VOLUMES
+
+# Let systemd restart this service always
+Restart=always
+
+# Specifies the maximum file descriptor number that can be opened by this process
+LimitNOFILE=1048576
+
+# Turn-off memory accounting by systemd, which is buggy.
+MemoryAccounting=no
+
+# Specifies the maximum number of threads this process can create
+TasksMax=infinity
+
+# Disable timeout logic and wait until process is stopped
+TimeoutSec=infinity
+
+# Disable killing of MinIO by the kernel's OOM killer
+OOMScoreAdjust=-1000
+
+SendSIGKILL=no
+
+[Install]
+WantedBy=multi-user.target
+
+# Built for ${project.name}-${project.version} (${project.name})