diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000000..617834f983
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,82 @@
+name: Talos Image
+
+on:
+  push:
+    branches: [ 'turingrk1', 'release-*' ]
+    tags:
+      - "v*"
+
+jobs:
+  talos-image:
+    runs-on: buildjet-4vcpu-ubuntu-2204-arm
+
+    permissions:
+      actions: read
+      contents: write
+      issues: read
+      packages: write
+      pull-requests: read
+
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # need history for `git describe` to work for Talos `Makefile`
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Build and push Talos installer image
+        run: make installer
+        env:
+          PUSH: '1'
+          USERNAME: ${{ github.actor }}
+          PLATFORM: linux/arm64
+          PROGRESS: plain
+          CI_ARGS: "--cache-from=ghcr.io/${{ github.actor }}/installer:cache --cache-to=ghcr.io/${{ github.actor }}/installer:cache"
+
+      - name: Build and push Talos imager image
+        run: make imager
+        env:
+          PUSH: '1'
+          USERNAME: ${{ github.actor }}
+          PLATFORM: linux/arm64
+          INSTALLER_ARCH: arm64
+          PROGRESS: plain
+          CI_ARGS: "--cache-from=ghcr.io/${{ github.actor }}/imager:cache --cache-to=ghcr.io/${{ github.actor }}/imager:cache"
+  
+      - name: release-notes
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          mkdir -p _out
+          make release-notes
+
+      - name: Build an turing-rk1 flashable image
+        run: make sbc-turing_rk1
+        env:
+          USERNAME: ${{ github.actor }}
+          PLATFORM: linux/arm64
+          PROGRESS: plain
+
+      - uses: actions/upload-artifact@v3
+        with:
+          name: image-turing-rk1
+          path: _out/*.raw.xz
+          if-no-files-found: error
+
+      - name: Release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: crazy-max/ghaction-github-release@v2
+        with:
+          body_path: _out/RELEASE_NOTES.md
+          draft: "true"
+          files: |
+            _out/metal-turing_rk1-arm64.raw.xz
diff --git a/hack/release.sh b/hack/release.sh
index 65d3cd6acd..306420d025 100755
--- a/hack/release.sh
+++ b/hack/release.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-RELEASE_TOOL_IMAGE="ghcr.io/siderolabs/release-tool:latest"
+RELEASE_TOOL_IMAGE="ghcr.io/nberlee/release-tool:09b5b10-dirty"
 
 function release-tool {
   docker pull "${RELEASE_TOOL_IMAGE}" >/dev/null
@@ -20,10 +20,6 @@ function changelog {
 
 function release-notes {
   release-tool "${2}" --gfm > "${1}"
-
-  echo -e '\n## Images\n\n```' >> ${1}
-  ${ARTIFACTS}/talosctl-linux-amd64 image default >> ${1}
-  echo -e '```\n' >> ${1}
 }
 
 function cherry-pick {