diff --git a/Makefile b/Makefile
index 0c7d203..516c946 100644
--- a/Makefile
+++ b/Makefile
@@ -9,7 +9,7 @@ GOOSARCHS = $(sort \
 			windows/amd64/.exe \
 			windows/arm64/.exe)
 
-VSN = $(shell git describe --dirty)
+VSN ?= $(shell git describe --dirty)
 VSNHASH = $(shell git rev-parse --verify HEAD)
 LDFLAGS = -ldflags "-X main.Version=$(VSN) -X main.VersionHash=$(VSNHASH)"
 
diff --git a/release b/release
new file mode 100755
index 0000000..d444c63
--- /dev/null
+++ b/release
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -euo pipefail
+
+err() {
+    >&2 echo "ERROR: $*"
+    exit 1
+}
+
+[[ -n "$(git status --porcelain)" ]] && \
+    err "working tree is dirty, commit your changes first."
+
+[[ ! "$1" =~ ^v([0-9]+)\.([0-9]+)(\.([0-9]+))?$ ]] && \
+    err "arg1 accepts the following formats: v1.0 v1.0.0"
+
+[[ -n "$(git tag | grep "^$1$")" ]] && \
+    err "tag $1 already exists"
+
+last_tag=$(git tag | tail -1)
+
+make -B -j$(nproc) VSN=$1 sha256sum.txt.asc
+
+{
+    echo undocker $1
+    echo
+    echo Changelog since $last_tag:
+    git log --pretty=format:"- [%cn] %s" $last_tag..HEAD
+    echo
+    echo
+    echo sha256sums of released binaries:
+    cat sha256sum.txt
+    echo
+} | git tag -u motiejus@jakstys.lt -F - "$1"