diff --git a/.github/workflows/publish-cli-releases.yaml b/.github/workflows/publish-cli-releases.yaml
new file mode 100644
index 00000000..9f1c14a0
--- /dev/null
+++ b/.github/workflows/publish-cli-releases.yaml
@@ -0,0 +1,63 @@
+name: Publish Binaries
+
+on:
+  push:
+    # tags:
+    #   - "v*.*.*"
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        os: [linux, darwin, windows]
+        arch: [amd64, arm64]
+
+    steps:
+      - name: git checkout
+        uses: actions/checkout@v3
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - name: Magic cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
+
+      - name: Build Kardinal CLI images
+        id: build-cli
+        shell: bash
+        run: |
+          path=$(nix build ./#cross-compiled-cli.x86_64-linux.${{ matrix.os }}.${{ matrix.arch }} --no-link --print-out-paths)
+          echo "path=$path" >> $GITHUB_OUTPUT
+
+      - name: Access it
+        run: |
+          echo "the secret number is ${{ steps.build-cli.outputs.path }}"
+
+      - name: Upload release assets
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: ${{ steps.build-cli.outputs.path }}/bin/${{ matrix.os }}_${{ matrix.arch }}/kardinal.cli
+          asset_name: kardinal-${{ matrix.os }}-${{ matrix.arch }}
+          asset_content_type: application/octet-stream
+
+  create-release:
+    needs: build-and-publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Create Release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ github.ref }}
+          release_name: Release ${{ github.ref }}
+          draft: false
+          prerelease: false
diff --git a/flake.nix b/flake.nix
index 43c2dfb1..d1504eaa 100644
--- a/flake.nix
+++ b/flake.nix
@@ -181,6 +181,31 @@
           in
             pkgs.lib.foldl' (set: acc: pkgs.lib.recursiveUpdate acc set) {}
             all;
+
+          cross-compiled-cli = let
+            all =
+              pkgs.lib.mapCartesianProduct ({
+                arch,
+                os,
+              }: {
+                "${os}" = {
+                  "${toString arch}" = packages.kardinal-cli.overrideAttrs (old:
+                    old
+                    // {
+                      GOOS = os;
+                      GOARCH = arch;
+                      # CGO_ENABLED = disabled breaks the CLI compilation
+                      # CGO_ENABLED = 0;
+                      doCheck = false;
+                    });
+                };
+              }) {
+                arch = architectures;
+                os = ["linux" "macos" "windows"];
+              };
+          in
+            pkgs.lib.foldl' (set: acc: pkgs.lib.recursiveUpdate acc set) {}
+            all;
         };
         # Add containers matching architecture with local system as toplevel packages
         # this means calling `nix build .#<SERVICE_NAME>-container` will build the container matching the local system.
diff --git a/scripts/install_cli.sh b/scripts/install_cli.sh
new file mode 100644
index 00000000..570c6a75
--- /dev/null
+++ b/scripts/install_cli.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+REPO="owner/repo"         # Replace with the actual repository, e.g., "cli/cli"
+BINARY_NAME="binary_name" # Replace with the actual binary name, e.g., "gh"
+
+OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+ARCH=$(uname -m)
+
+if [[ "$ARCH" == "x86_64" ]]; then
+	ARCH="amd64"
+elif [[ "$ARCH" == "arm64" ]]; then
+	ARCH="arm64"
+elif [[ "$ARCH" == "aarch64" ]]; then
+	ARCH="arm64"
+elif [[ "$ARCH" == "i386" ]]; then
+	ARCH="386"
+fi
+
+LATEST_RELEASE=$(curl -s "https://api.github.com/repos/$REPO/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
+
+DOWNLOAD_URL="https://github.com/$REPO/releases/download/$LATEST_RELEASE/${BINARY_NAME}-${OS}-${ARCH}.tar.gz"
+curl -L $DOWNLOAD_URL -o /tmp/${BINARY_NAME}.tar.gz
+
+tar -xzf /tmp/${BINARY_NAME}.tar.gz -C /tmp
+sudo mv /tmp/$BINARY_NAME /usr/local/bin/$BINARY_NAME
+
+rm /tmp/${BINARY_NAME}.tar.gz
+
+if [ -f /usr/local/bin/$BINARY_NAME ]; then
+	if [ -d /usr/share/bash-completion/completions ]; then
+		sudo curl -L "https://raw.githubusercontent.com/$REPO/$LATEST_RELEASE/completions/$BINARY_NAME.bash" -o /usr/share/bash-completion/completions/$BINARY_NAME
+		source /usr/share/bash-completion/completions/$BINARY_NAME
+	fi
+
+	if [ -d ~/.zsh/completions ]; then
+		sudo curl -L "https://raw.githubusercontent.com/$REPO/$LATEST_RELEASE/completions/_$BINARY_NAME" -o ~/.zsh/completions/_$BINARY_NAME
+		fpath=(~/.zsh/completions $fpath)
+		autoload -Uz compinit && compinit
+	elif [ -d /usr/local/share/zsh/site-functions ]; then
+		sudo curl -L "https://raw.githubusercontent.com/$REPO/$LATEST_RELEASE/completions/_$BINARY_NAME" -o /usr/local/share/zsh/site-functions/_$BINARY_NAME
+	fi
+
+	if [ -d ~/.config/fish/completions ]; then
+		sudo curl -L "https://raw.githubusercontent.com/$REPO/$LATEST_RELEASE/completions/$BINARY_NAME.fish" -o ~/.config/fish/completions/$BINARY_NAME.fish
+	elif [ -d /usr/share/fish/vendor_completions.d ]; then
+		sudo curl -L "https://raw.githubusercontent.com/$REPO/$LATEST_RELEASE/completions/$BINARY_NAME.fish" -o /usr/share/fish/vendor_completions.d/$BINARY_NAME.fish
+	fi
+fi
+
+echo "$BINARY_NAME has been installed successfully!"
+
+if ! command -v $BINARY_NAME &>/dev/null; then
+	echo "export PATH=\$PATH:/usr/local/bin" >>~/.bashrc
+	source ~/.bashrc
+	echo "export PATH=\$PATH:/usr/local/bin" >>~/.zshrc
+	source ~/.zshrc
+	echo "set -gx PATH \$PATH /usr/local/bin" >>~/.config/fish/config.fish
+	source ~/.config/fish/config.fish
+fi