diff --git a/.gitignore b/.gitignore
index 9862355479..269d23676a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,5 @@ build/
 pgp/keyrings/aptly2*.gpg
 pgp/keyrings/aptly2*.gpg~
 pgp/keyrings/.#*
+
+dist/
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000000..b970e525d6
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,21 @@
+# Check the documentation at https://goreleaser.com
+before:
+  hooks:
+    - rm -rf ./dist
+    - go mod tidy
+    - go generate ./...
+builds:
+  - env: [CGO_ENABLED=0]
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+
+nfpms:
+- file_name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Arch }}'
+  maintainer: 'Bobby Zhang'
+  license: MIT
+  formats:
+  - deb
+  - rpm
diff --git a/system/requirements.txt b/system/requirements.txt
index 39b43f1562..6dd240f5c1 100644
--- a/system/requirements.txt
+++ b/system/requirements.txt
@@ -4,3 +4,4 @@ requests-unixsocket
 python-swiftclient
 flake8
 termcolor
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability