diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98b1bfc..432ca07 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,13 +65,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install kustomize
+      - name: Install kustomize and kubectl
         run: |
           set -e
           if ! command -v kustomize >/dev/null 2>&1; then
             curl -sSL "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash -s 5.0.0
             sudo mv kustomize /usr/local/bin/kustomize || true
           fi
+          if ! command -v kubectl >/dev/null 2>&1; then
+            curl -sSL -o kubectl https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl
+            chmod +x kubectl
+            sudo mv kubectl /usr/local/bin/kubectl
+          fi
 
       - name: Run kustomize build for known directories
         run: |
@@ -85,6 +90,21 @@ jobs:
           done
           $ok || (echo "One or more kustomize builds failed" && exit 1)
 
+      - name: Kustomize -> kubectl --dry-run=client validation
+        run: |
+          set -e
+          any=false
+          for d in config config/*; do
+            if [ -d "$d" ] && ( [ -f "$d/kustomization.yaml" ] || [ -f "$d/kustomization.yml" ] ); then
+              echo "Validating manifests from $d with kubectl --dry-run=client"
+              kustomize build "$d" | kubectl apply --dry-run=client -f - || { echo "kubectl --dry-run failed for $d"; exit 1; }
+              any=true
+            fi
+          done
+          if [ "$any" = false ]; then
+            echo "No kustomize directories found to validate with kubectl"
+          fi
+
   release:
     name: Create release artifact
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..c8340df
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,34 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    name: Create GitHub Release and upload artifact
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create tarball
+        run: |
+          tar -czf awx-local-setup-${{ github.ref_name }}.tar.gz awx-local-setup
+
+      - name: Create GitHub Release
+        id: create_release
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ github.ref_name }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload release asset
+        uses: actions/upload-release-asset@v1
+        with:
+          upload_url: ${{ steps.create_release.outputs.upload_url }}
+          asset_path: ./awx-local-setup-${{ github.ref_name }}.tar.gz
+          asset_name: awx-local-setup-${{ github.ref_name }}.tar.gz
+          asset_content_type: application/gzip