diff --git a/.build.yml b/.build.yml
index 233566c..2152773 100644
--- a/.build.yml
+++ b/.build.yml
@@ -30,3 +30,6 @@ tasks:
       shellcheck -x $(awk '/#!\/bin\/(ba)?sh/&&FNR==1{print FILENAME}' $(git ls-files))
       bazel run //:buildifier
       git diff --exit-code
+  - test_release: |
+      cd bazel-zig-cc; . .envrc
+      ./ci/release
diff --git a/ci/release b/ci/release
new file mode 100755
index 0000000..a61c374
--- /dev/null
+++ b/ci/release
@@ -0,0 +1,18 @@
+#!/bin/bash
+set -xeuo pipefail
+
+parent_ref=$(git rev-parse HEAD)
+cd "$(git rev-parse --show-toplevel)"
+./release --nosign v99.0
+trap "git tag -d v99.0; git reset --hard $parent_ref" EXIT
+
+want=" 1 file changed, 2 insertions(+), 2 deletions(-)"
+got=$(git show --shortstat HEAD | tail -1)
+
+if [[ "$want" != "$got" ]]; then
+    echo wanted:
+    echo \ \ "$want"
+    echo got:
+    echo \ \ "$got"
+    exit 1
+fi
diff --git a/release b/release
index 56c5ed8..c3a4976 100755
--- a/release
+++ b/release
@@ -1,6 +1,9 @@
 #!/bin/bash
 set -xeuo pipefail
 
+sign=(-u motiejus@jakstys.lt)
+[[ $1 == "--nosign" ]] && { sign=(); shift; }
+
 _err(){ >&2 echo "ERROR: $*"; exit 1; }
 
 git status --porcelain | grep -q "" &&
@@ -20,7 +23,7 @@ last_tag=$(git tag | tail -1)
     echo Changelog since "$last_tag":
     git log --pretty=format:"- [%an] %s" "$last_tag"..HEAD | \
         grep -v "Update release notes for $last_tag"
-} | git tag -u motiejus@jakstys.lt -F - "$1"
+} | git tag "${sign[@]}" -F - "$1"
 
 shasum=$(git archive --prefix="bazel-zig-cc-$1/" --format=tar "$1" | \
     gzip -n | sha256sum | cut -f1 -d" ")