diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 22b499b0..4db74dc5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,3 +34,37 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # The macOS server links cgo against Virtualization.framework, so it can't be
+  # cross-compiled from the Linux release job — it builds on a macOS arm64 runner.
+  release-darwin:
+    needs: release
+    runs-on: macos-14
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.4'
+
+      - name: Build server and token tool
+        run: |
+          make build-darwin
+          go build -o bin/hypeman-token ./cmd/gen-jwt
+
+      - name: Package and upload darwin_arm64 archive
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          STAGE="$(mktemp -d)"
+          cp bin/hypeman "${STAGE}/hypeman-api"
+          cp bin/hypeman-token "${STAGE}/hypeman-token"
+          cp config.example.darwin.yaml "${STAGE}/"
+          ARCHIVE="hypeman_${VERSION}_darwin_arm64.tar.gz"
+          tar -czf "${ARCHIVE}" -C "${STAGE}" .
+          gh release upload "${GITHUB_REF_NAME}" "${ARCHIVE}" --clobber