diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
new file mode 100644
index 0000000..2473b1b
--- /dev/null
+++ b/.github/workflows/build-linux.yml
@@ -0,0 +1,27 @@
+# .github/workflows/build.yml
+name: Build Linux
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    name: Build Linux
+    runs-on: self-hosted
+    steps:
+      - uses: actions/checkout@master
+      - name: Compile
+        id: compile
+        uses: rust-build/rust-build.action@v1.4.5
+        with:
+          RUSTTARGET: x86_64-unknown-linux-musl
+          UPLOAD_MODE: none
+          TOOLCHAIN_VERSION: stable
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Binary
+          path: |
+            ${{ steps.compile.outputs.BUILT_ARCHIVE }}
+            ${{ steps.compile.outputs.BUILT_CHECKSUM }}
\ No newline at end of file
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
new file mode 100644
index 0000000..77943d5
--- /dev/null
+++ b/.github/workflows/build-release.yml
@@ -0,0 +1,24 @@
+# .github/workflows/build-all.yml
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  release:
+    name: release ${{ matrix.target }}
+    runs-on: self-hosted
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [x86_64-pc-windows-gnu, x86_64-unknown-linux-musl]
+    steps:
+      - uses: actions/checkout@master
+      - name: Compile and release
+        uses: rust-build/rust-build.action@v1.4.5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          RUSTTARGET: ${{ matrix.target }}
+          EXTRA_FILES: "README.md LICENSE"
+          TOOLCHAIN_VERSION: stable
\ No newline at end of file
diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
new file mode 100644
index 0000000..abe4d28
--- /dev/null
+++ b/.github/workflows/build-windows.yml
@@ -0,0 +1,36 @@
+# .github/workflows/build.yml
+name: Build Windows
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    name: Build Windows
+    runs-on:  [self-hosted, windows]
+    steps:
+      - uses: actions/checkout@master
+      - name: Compile Rust
+        id: compile
+        run: |
+          cargo build --release
+      - name: Compile Python
+        run: |
+          pip install pyinstaller
+          cd gui; pyinstaller --add-data '*.png:.' --icon=logo.ico --onefile gui.py
+      - name: Move to build folder for Wix
+        run: |
+          mv target/release/ftm.exe build/ftm.exe
+          mv gui/dist/gui.exe build/gui.exe
+      - name: Create MSI
+        run: |
+          cd build; candle .\file-time-machine.wxs; light .\file-time-machine.wixobj
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Windows binaries and installer
+          path: |
+            build/file-time-machine.msi
+            build/ftm.exe
+            build/gui.exe
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 0000000..ca085cc
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,24 @@
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+    - main
+    - master
+    paths:
+    - .github/workflows/semgrep.yml
+  schedule:
+  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+  - cron: 26 4 * * *
+name: Semgrep
+jobs:
+  semgrep:
+    name: semgrep/ci
+    runs-on: ubuntu-20.04
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: returntocorp/semgrep
+    steps:
+    - uses: actions/checkout@v4
+    - run: semgrep ci