diff --git a/.github/workflows/master-tarball.yml b/.github/workflows/master-tarball.yml
new file mode 100644
index 0000000..524619d
--- /dev/null
+++ b/.github/workflows/master-tarball.yml
@@ -0,0 +1,70 @@
+name: Build and publish tarball
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  tarball:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: oven-sh/setup-bun@v2
+
+      - run: bun install
+
+      - run: bun test
+
+      - run: bun run typecheck
+
+      - run: bun run build
+
+      - name: Pack tarball
+        run: npm pack
+
+      - name: Rename tarball to fixed name
+        run: mv *.tgz opencode-kiro-auth.tgz
+
+      - name: Check if release exists
+        id: check_release
+        run: |
+          if gh release view "_master" >/dev/null 2>&1; then
+            echo "release_exists=true" >> $GITHUB_ENV
+          else
+            echo "release_exists=false" >> $GITHUB_ENV
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create release if missing
+        if: env.release_exists != 'true'
+        run: |
+          gh release create "_master" \
+            --target master \
+            --prerelease \
+            --title "Nightly Build master" \
+            --notes "Nightly build. Commit: ${{ github.sha }}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Ensure _master tag points at HEAD
+        run: |
+          git tag -f _master HEAD
+          git push origin _master --force
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Delete old tarball asset
+        run: gh release delete-asset _master opencode-kiro-auth.tgz --yes || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload tarball
+        run: gh release upload _master opencode-kiro-auth.tgz --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5e6bc3e..e5c3b80 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: oven-sh/setup-bun@v2
 
diff --git a/.gitignore b/.gitignore
index 080cb87..4ae4bf9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ dist/
 *.tsbuildinfo
 .vscode/*
 .sisyphus
+*.tgz