diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a6f0af8..d6569dc 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -3,14 +3,60 @@ name: CI pipeline
 on: push
 
 jobs:
-  build:
+  debug:
     runs-on: macos-14
 
     steps:
     - uses: actions/checkout@v3
 
+    - name: Build code
+      run: make debug
+
+  release:
+    runs-on: macos-14
+    environment: release-macos
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Install the Apple certificate and provisioning profile
+      env:
+        BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
+        P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+        BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
+        KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+      run: |
+        # create variables
+        CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+        PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
+        KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+
+        # import certificate and provisioning profile from secrets
+        # note: I don't think we actually need the provisioning profile currently
+        echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
+        echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH
+
+        # create temporary keychain
+        security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+        security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+        security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
+        # import certificate to keychain
+        security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+        security list-keychain -d user -s $KEYCHAIN_PATH
+
+        # apply provisioning profile
+        mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+        cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles
+
     - name: Build code
       run: make release
 
     - name: Run check
-      run: make check
+      run: make check-release
+
+    - name: Clean up keychain and provisioning profile
+      if: ${{ always() }}
+      run: |
+        security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
+        rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision
diff --git a/CHANGES b/CHANGES
index 0885808..47b915f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+0.1-4 | 2024-01-21 07:57:15 +0100
+
+  * Tweak CI.
+
 0.1-3 | 2024-01-20 22:29:20 +0100
 
   * Polish code infrastructure.
diff --git a/Makefile b/Makefile
index 2454208..19cb641 100644
--- a/Makefile
+++ b/Makefile
@@ -7,6 +7,6 @@ debug:
 release:
 	@xcodebuild -quiet -target qlview-signed -configuration Release
 
-check:
+check-release:
 	codesign --verify --verbose build/Release/qlview
 	codesign --display --verbose=4 build/Release/qlview 2>&1 | grep Signed
diff --git a/VERSION b/VERSION
index 2eaed16..653402d 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.1-3
+0.1-4
diff --git a/qlview/Info.plist b/qlview/Info.plist
index 9ab382b..0269d45 100644
--- a/qlview/Info.plist
+++ b/qlview/Info.plist
@@ -9,6 +9,6 @@
 	<key>CFBundleName</key>
 	<string>qlview</string>
 	<key>CFBundleVersion</key>
-	<string>0.1-3</string>
+	<string>0.1-4</string>
 </dict>
 </plist>