diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1b47839b..d6fc307e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,6 +16,9 @@ jobs:
       issues: write
       pull-requests: write
       id-token: write
+    outputs:
+      new-release-published: ${{ steps.semantic.outputs.new-release-published }}
+      new-release-version: ${{ steps.semantic.outputs.new-release-version }}
     steps:
       - name: Generate token
         id: generate_token
@@ -37,7 +40,48 @@ jobs:
       - run: npm ci
 
       - name: Run semantic-release
+        id: semantic
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
           HUSKY: "0"
         run: npx semantic-release
+
+  firmware:
+    name: Build and attach firmware
+    needs: release
+    if: needs.release.outputs.new-release-published == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Generate token
+        id: generate_token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ secrets.RELEASE_APP_ID }}
+          private_key: ${{ secrets.RELEASE_APP_SECRET }}
+
+      - uses: actions/checkout@v4
+        with:
+          ref: v${{ needs.release.outputs.new-release-version }}
+
+      - name: Install ARM toolchain
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends gcc-arm-none-eabi libnewlib-arm-none-eabi
+
+      - name: Build firmware
+        run: make firmware
+
+      - name: Attach firmware to release
+        env:
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: |
+          VERSION="v${{ needs.release.outputs.new-release-version }}"
+          BUILD_DIR=".build/micropython-steami/ports/stm32/build-STEAM32_WB55RG"
+          cp "${BUILD_DIR}/firmware.hex" "steami-micropython-firmware-${VERSION}.hex"
+          cp "${BUILD_DIR}/firmware.bin" "steami-micropython-firmware-${VERSION}.bin"
+          gh release upload "$VERSION" \
+            "steami-micropython-firmware-${VERSION}.hex" \
+            "steami-micropython-firmware-${VERSION}.bin" \
+            --clobber
diff --git a/.releaserc.json b/.releaserc.json
index 9ec68197..5393e067 100644
--- a/.releaserc.json
+++ b/.releaserc.json
@@ -24,7 +24,8 @@
       "changelogTitle": "# Changelog\n\nAll notable changes to this project will be documented in this file.\nSee [Conventional Commits](https://conventionalcommits.org) for commit guidelines."
     }],
     ["@semantic-release/exec", {
-      "prepareCmd": "sed -i 's/^version = \".*\"/version = \"${nextRelease.version}\"/' pyproject.toml"
+      "prepareCmd": "sed -i 's/^version = \".*\"/version = \"${nextRelease.version}\"/' pyproject.toml",
+      "publishCmd": "[ -n \"${GITHUB_OUTPUT:-}\" ] && { echo 'new-release-published=true' >>\"$GITHUB_OUTPUT\"; echo \"new-release-version=${nextRelease.version}\" >>\"$GITHUB_OUTPUT\"; } || true"
     }],
     ["@semantic-release/git", {
       "assets": ["CHANGELOG.md", "pyproject.toml"],