diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 29890de1..16e3ad57 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -321,6 +321,49 @@ jobs:
         id: deployment
         uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
 
+  release-cli-artifacts:
+    name: Release CLI Artifacts
+    needs: [prepare, ci_required]
+    if: ${{ needs.prepare.outputs.publish_packages == 'true' && needs.ci_required.result == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+    steps:
+      - name: Download CLI binary artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: cli-*
+          merge-multiple: true
+          path: release-assets/
+
+      - name: Generate CLI release checksums
+        run: |
+          set -euo pipefail
+
+          (
+            cd release-assets
+            cli_assets=(nemo-flow-cli-*)
+            sha256sum "${cli_assets[@]}" > SHA256SUMS
+            sha256sum --check SHA256SUMS
+
+            while read -r digest filename; do
+              printf '%s  %s\n' "$digest" "$filename" > "${filename}.sha256"
+            done < SHA256SUMS
+
+            printf 'CLI release assets:\n'
+            printf '  release-assets/%s\n' *
+          )
+
+      - name: Upload CLI assets and checksums to draft GitHub Release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        with:
+          draft: true
+          prerelease: ${{ contains(github.ref_name, '-beta.') || contains(github.ref_name, '-rc.') }}
+          overwrite_files: true
+          fail_on_unmatched_files: true
+          files: release-assets/*
+
   publish-rust:
     name: Publish (crates.io)
     needs: [prepare, ci_required]
diff --git a/.github/workflows/ci_rust.yml b/.github/workflows/ci_rust.yml
index d275dfc1..fb956d52 100644
--- a/.github/workflows/ci_rust.yml
+++ b/.github/workflows/ci_rust.yml
@@ -167,14 +167,19 @@ jobs:
         include:
           - platform: linux-amd64
             runner: ubuntu-latest
+            target: x86_64-unknown-linux-musl
           - platform: linux-arm64
             runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-musl
           - platform: macos-arm64
             runner: macos-15
+            target: aarch64-apple-darwin
           - platform: windows-amd64
             runner: windows-2022
+            target: x86_64-pc-windows-msvc
           - platform: windows-arm64
             runner: windows-11-arm
+            target: aarch64-pc-windows-msvc
 
     steps:
       - name: Checkout
@@ -188,6 +193,7 @@ jobs:
         with:
           cache: false
           toolchain: ${{ steps.ci-config.outputs.rust_version }}
+          target: ${{ matrix.target }}
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
@@ -197,27 +203,42 @@ jobs:
           cache-bin: false
           save-if: false
 
+      - name: Install musl tools
+        if: ${{ startsWith(matrix.target, 'x86_64-unknown-linux-musl') || startsWith(matrix.target, 'aarch64-unknown-linux-musl') }}
+        run: |
+          set -e
+          sudo apt-get update
+          sudo apt-get install -y musl-tools
+
       - name: Build CLI release binary
         working-directory: ${{ env.NEMO_FLOW_CI_WORKSPACE }}
         run: |
           set -e
-          cargo build --release -p nemo-flow-cli
+          cargo build --release --target "${{ matrix.target }}" -p nemo-flow-cli
 
       - name: Stage CLI binary artifact
         working-directory: ${{ env.NEMO_FLOW_CI_WORKSPACE }}
         run: |
           set -euo pipefail
+          target="${{ matrix.target }}"
+          version="${{ github.ref_name }}"
+          if [ "${{ github.ref_type }}" != "tag" ]; then
+            version="dev-${GIT_COMMIT::8}"
+          fi
           binary="nemo-flow"
+          asset="nemo-flow-cli-${target}-${version}"
           if [ "${{ runner.os }}" = "Windows" ]; then
             binary="${binary}.exe"
+            asset="${asset}.exe"
           fi
-          source="${NEMO_FLOW_CI_WORKSPACE}/target/release/${binary}"
+          source="${NEMO_FLOW_CI_WORKSPACE}/target/${target}/release/${binary}"
           if [ ! -f "$source" ]; then
             echo "Error: expected CLI binary at ${source}" >&2
             exit 1
           fi
+          rm -rf "${NEMO_FLOW_CI_WORKSPACE_TMP}/cli"
           mkdir -p "${NEMO_FLOW_CI_WORKSPACE_TMP}/cli"
-          cp "$source" "${NEMO_FLOW_CI_WORKSPACE_TMP}/cli/${binary}"
+          cp "$source" "${NEMO_FLOW_CI_WORKSPACE_TMP}/cli/${asset}"
 
       - name: Upload CLI binary artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 14969c06..4316643a 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -13,6 +13,10 @@ description = "Coding-agent gateway CLI for NeMo Flow observability."
 name = "nemo-flow"
 path = "src/main.rs"
 
+[package.metadata.binstall]
+pkg-url = "{ repo }/releases/download/{ version }/{ name }-{ target }-{ version }{ binary-ext }"
+pkg-fmt = "bin"
+
 [lints]
 workspace = true