diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..deb03a4e
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,38 @@
+name: Release mesh-security
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+permissions:
+  contents: read
+
+jobs:
+  release:
+    permissions:
+      contents: write # for goreleaser/goreleaser-action to create a GitHub release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.20"
+          check-latest: true
+      - name: Build demo app artifact
+        run: make build-linux-static
+
+      - name: Create release
+        uses: softprops/action-gh-release@v1
+        if: startsWith(github.ref, 'refs/tags/')
+        id: create_release
+        with:
+          draft: false
+          prerelease: false
+          body_path: RELEASE_NOTES.md
+          files: |
+            demo/build/*
+            tests/e2e/build/*
diff --git a/Makefile b/Makefile
index 966b51d6..77d30278 100644
--- a/Makefile
+++ b/Makefile
@@ -23,6 +23,10 @@ install:
 build:
 	$(MAKE) -C demo build
 
+build-linux-static:
+	$(MAKE) -C demo build-linux-static
+	$(MAKE) -C tests/e2e build-linux
+
 ########################################
 ### Testing
 
@@ -79,5 +83,5 @@ proto-check-breaking:
 
 
 .PHONY: all install \
-	build test test-all \
+	build build-linux-static test test-all \
 	proto-all proto-format proto-swagger-gen proto-lint proto-check-breaking
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
new file mode 100644
index 00000000..aa054b56
--- /dev/null
+++ b/RELEASE_NOTES.md
@@ -0,0 +1 @@
+# Release
diff --git a/demo/Dockerfile b/demo/Dockerfile
new file mode 100644
index 00000000..810279e8
--- /dev/null
+++ b/demo/Dockerfile
@@ -0,0 +1,39 @@
+FROM golang:1.20-alpine AS go-builder
+ARG ARCH=x86_64
+
+RUN apk add --no-cache ca-certificates build-base git
+
+WORKDIR /code
+
+# Download dependencies and CosmWasm libwasmvm if found.
+ADD go.mod go.sum ./
+
+#ADD https://github.com/CosmWasm/wasmvm/releases/download/v$wasmvm/libwasmvm_muslc.$arch.a /lib/libwasmvm_muslc.$arch.a
+## Download
+RUN set -eux; \
+    WASM_VERSION=v$(go list -m github.com/CosmWasm/wasmvm | cut -d" " -f2 | cut -d"v" -f2); \
+    echo $WASM_VERSION; \
+    wget -O /lib/libwasmvm_muslc.a https://github.com/CosmWasm/wasmvm/releases/download/${WASM_VERSION}/libwasmvm_muslc.${ARCH}.a
+
+# Copy over code
+COPY . /code
+
+# force it to use static lib (from above) not standard libgo_cosmwasm.so file
+# then log output of file /code/bin/meshd
+# then ensure static linking
+RUN LEDGER_ENABLED=false BUILD_TAGS=muslc LINK_STATICALLY=true make build-vendored \
+  && file /code/build/meshd \
+  && echo "Ensuring binary is statically linked ..." \
+  && (file /code/build/meshd | grep "statically linked")
+
+# --------------------------------------------------------
+FROM alpine:3.16
+
+COPY --from=go-builder /code/build/meshd /usr/bin/meshd
+
+WORKDIR /opt
+
+# rest server, tendermint p2p, tendermint rpc
+EXPOSE 1317 26656 26657
+
+CMD ["/usr/bin/meshd", "version"]
\ No newline at end of file
diff --git a/demo/Makefile b/demo/Makefile
index cdde39f0..7f519aca 100644
--- a/demo/Makefile
+++ b/demo/Makefile
@@ -5,7 +5,7 @@ VERSION := $(shell echo $(shell git describe --tags) | sed 's/^v//')
 COMMIT := $(shell git log -1 --format='%H')
 LEDGER_ENABLED ?= true
 BINDIR ?= $(GOPATH)/bin
-SIMAPP = .
+BUILD_DIR = ./build
 
 export GO111MODULE = on
 
@@ -76,9 +76,21 @@ ifeq ($(OS),Windows_NT)
 	$(error mesh demo server not supported)
 	exit 1
 else
-	go build -mod=readonly $(BUILD_FLAGS) -o build/meshd ./cmd/meshd
+	go build -mod=readonly $(BUILD_FLAGS) -o $(BUILD_DIR)/meshd ./cmd/meshd
 endif
 
+build-vendored:
+	go build -mod=vendor $(BUILD_FLAGS) -o $(BUILD_DIR)/meshd ./cmd/meshd
+
+build-linux-static:
+	go mod vendor  # quick hack to make local dependencies work in Docker
+	mkdir -p $(BUILD_DIR)
+	docker build --tag osmosis/meshd:local ./
+	docker create --name meshd_temp osmosis/meshd:local
+	docker cp meshd_temp:/usr/bin/meshd $(BUILD_DIR)/
+	docker rm -f meshd_temp
+	rm -rf vendor/
+
 install:
 	go install -mod=readonly $(BUILD_FLAGS) ./cmd/meshd
 
@@ -106,6 +118,6 @@ test-sim-multi-seed-short: runsim
 	@$(BINDIR)/runsim -Jobs=4 -SimAppPkg=$(SIMAPP) -ExitOnFail 50 10 TestFullAppSimulation
 
 .PHONY: all \
-	go-mod-cache draw-deps clean build  \
+	go-mod-cache draw-deps clean build build-linux-static build-vendored \
 	test test-all test-build test-cover test-unit test-race \
 	proto-all proto-format proto-swagger-gen proto-lint proto-check-breaking
diff --git a/tests/e2e/Makefile b/tests/e2e/Makefile
index d6713c6e..40927b00 100644
--- a/tests/e2e/Makefile
+++ b/tests/e2e/Makefile
@@ -1,8 +1,16 @@
 #!/usr/bin/make -f
 
+BUILD_DIR = ./build
+
 all: test
 
 test:
 	go test -mod=readonly -race ./...
 
-.PHONY: all  test
+build:
+	CGO_ENABLED=1 go test -c -mod=readonly -o $(BUILD_DIR)/mesh-security.e2e.test
+
+build-linux:
+	CGO_ENABLED=1  GOOS=linux go test -c -mod=readonly -o $(BUILD_DIR)/mesh-security.e2e.test
+
+.PHONY: all build build-linux test