diff --git a/.cirrus.yml b/.cirrus.yml
index d9f63ec..182c07a 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -122,6 +122,27 @@ release_linux_x86_64_plain-binaries_docker_builder:
   depends_on:
     - "release_linux_x86_64_ncprop279"
 
+release_linux_x86_64_release_docker_builder:
+  timeout_in: 120m
+  out_release_linux_x86_64_cache:
+    folder: out
+    fingerprint_script:
+      - "echo out_release_linux_x86_64"
+    reupload_on_changes: true
+    populate_script:
+      - "mkdir -p out"
+  git_release_linux_x86_64_cache:
+    folder: git_clones
+    fingerprint_script:
+      - "echo git_release_linux_x86_64"
+    reupload_on_changes: true
+    populate_script:
+      - "mkdir -p git_clones"
+  build_script:
+    - "./tools/cirrus_build_project.sh release release linux x86_64 1"
+  depends_on:
+    - "release_linux_x86_64_plain-binaries"
+
 release_linux_i686_download_docker_builder:
   timeout_in: 120m
   out_release_linux_i686_cache:
@@ -246,6 +267,27 @@ release_linux_i686_plain-binaries_docker_builder:
   depends_on:
     - "release_linux_i686_ncprop279"
 
+release_linux_i686_release_docker_builder:
+  timeout_in: 120m
+  out_release_linux_i686_cache:
+    folder: out
+    fingerprint_script:
+      - "echo out_release_linux_i686"
+    reupload_on_changes: true
+    populate_script:
+      - "mkdir -p out"
+  git_release_linux_i686_cache:
+    folder: git_clones
+    fingerprint_script:
+      - "echo git_release_linux_i686"
+    reupload_on_changes: true
+    populate_script:
+      - "mkdir -p git_clones"
+  build_script:
+    - "./tools/cirrus_build_project.sh release release linux i686 1"
+  depends_on:
+    - "release_linux_i686_plain-binaries"
+
 release_windows_x86_64_download_docker_builder:
   timeout_in: 120m
   out_release_windows_x86_64_cache:
@@ -370,6 +412,27 @@ release_windows_x86_64_plain-binaries_docker_builder:
   depends_on:
     - "release_windows_x86_64_ncprop279"
 
+release_windows_x86_64_release_docker_builder:
+  timeout_in: 120m
+  out_release_windows_x86_64_cache:
+    folder: out
+    fingerprint_script:
+      - "echo out_release_windows_x86_64"
+    reupload_on_changes: true
+    populate_script:
+      - "mkdir -p out"
+  git_release_windows_x86_64_cache:
+    folder: git_clones
+    fingerprint_script:
+      - "echo git_release_windows_x86_64"
+    reupload_on_changes: true
+    populate_script:
+      - "mkdir -p git_clones"
+  build_script:
+    - "./tools/cirrus_build_project.sh release release windows x86_64 1"
+  depends_on:
+    - "release_windows_x86_64_plain-binaries"
+
 release_windows_i686_download_docker_builder:
   timeout_in: 120m
   out_release_windows_i686_cache:
@@ -494,3 +557,24 @@ release_windows_i686_plain-binaries_docker_builder:
   depends_on:
     - "release_windows_i686_ncprop279"
 
+release_windows_i686_release_docker_builder:
+  timeout_in: 120m
+  out_release_windows_i686_cache:
+    folder: out
+    fingerprint_script:
+      - "echo out_release_windows_i686"
+    reupload_on_changes: true
+    populate_script:
+      - "mkdir -p out"
+  git_release_windows_i686_cache:
+    folder: git_clones
+    fingerprint_script:
+      - "echo git_release_windows_i686"
+    reupload_on_changes: true
+    populate_script:
+      - "mkdir -p git_clones"
+  build_script:
+    - "./tools/cirrus_build_project.sh release release windows i686 1"
+  depends_on:
+    - "release_windows_i686_plain-binaries"
+
diff --git a/Makefile b/Makefile
index 9408170..e59a7b9 100644
--- a/Makefile
+++ b/Makefile
@@ -2,51 +2,50 @@ rbm=./rbm/rbm
 
 all: release
 
-# TODO: Replace the Makefile-based metatarget with an rbm-based one.
-release: submodule-update release-linux-x86_64 release-linux-i686 release-windows-x86_64 release-windows-i686 release-osx-x86_64
-	#$(rbm) build plain-binaries --target release --target ncdns-all
+release: submodule-update
+	$(rbm) build release --target release --target ncdns-all
 
 release-android-armv7: submodule-update
-	$(rbm) build plain-binaries --target release --target ncdns-android-armv7
+	$(rbm) build release --target release --target ncdns-android-armv7
 
 release-android-x86: submodule-update
-	$(rbm) build plain-binaries --target release --target ncdns-android-x86
+	$(rbm) build release --target release --target ncdns-android-x86
 
 release-android-x86_64: submodule-update
-	$(rbm) build plain-binaries --target release --target ncdns-android-x86_64
+	$(rbm) build release --target release --target ncdns-android-x86_64
 
 release-android-aarch64: submodule-update
-	$(rbm) build plain-binaries --target release --target ncdns-android-aarch64
+	$(rbm) build release --target release --target ncdns-android-aarch64
 
 release-linux-x86_64: submodule-update
 	$(rbm) build certdehydrate-dane-rest-api --target release --target ncdns-linux-x86_64
 	$(rbm) build dnssec-hsts --target release --target ncdns-linux-x86_64
 	$(rbm) build dnssec-hsts-native --target release --target ncdns-linux-x86_64
-	$(rbm) build plain-binaries --target release --target ncdns-linux-x86_64
+	$(rbm) build release --target release --target ncdns-linux-x86_64
 
 release-linux-i686: submodule-update
 	$(rbm) build certdehydrate-dane-rest-api --target release --target ncdns-linux-i686
 	$(rbm) build dnssec-hsts --target release --target ncdns-linux-i686
 	$(rbm) build dnssec-hsts-native --target release --target ncdns-linux-i686
-	$(rbm) build plain-binaries --target release --target ncdns-linux-i686
+	$(rbm) build release --target release --target ncdns-linux-i686
 
 release-windows-i686: submodule-update
 	$(rbm) build certdehydrate-dane-rest-api --target release --target ncdns-windows-i686
 	$(rbm) build dnssec-hsts --target release --target ncdns-windows-i686
 	$(rbm) build dnssec-hsts-native --target release --target ncdns-windows-i686
-	$(rbm) build plain-binaries --target release --target ncdns-windows-i686
+	$(rbm) build release --target release --target ncdns-windows-i686
 
 release-windows-x86_64: submodule-update
 	$(rbm) build certdehydrate-dane-rest-api --target release --target ncdns-windows-x86_64
 	$(rbm) build dnssec-hsts --target release --target ncdns-windows-x86_64
 	$(rbm) build dnssec-hsts-native --target release --target ncdns-windows-x86_64
-	$(rbm) build plain-binaries --target release --target ncdns-windows-x86_64
+	$(rbm) build release --target release --target ncdns-windows-x86_64
 
 release-osx-x86_64: submodule-update
 	$(rbm) build certdehydrate-dane-rest-api --target release --target ncdns-osx-x86_64
 	$(rbm) build dnssec-hsts --target release --target ncdns-osx-x86_64
 	$(rbm) build dnssec-hsts-native --target release --target ncdns-osx-x86_64
-	$(rbm) build plain-binaries --target release --target ncdns-osx-x86_64
+	$(rbm) build release --target release --target ncdns-osx-x86_64
 
 submodule-update:
 	./setup-submodule-symlinks
diff --git a/projects/release/build b/projects/release/build
new file mode 100644
index 0000000..e475230
--- /dev/null
+++ b/projects/release/build
@@ -0,0 +1,48 @@
+#!/bin/sh
+[% c("var/set_default_env") -%]
+# reset HOME which was changed by var/set_default_env, for gpg
+[% IF ENV.HOME %]export HOME="[% ENV.HOME %]"[% END %]
+destdir="[% dest_dir _ '/' _ c("var/publish_dir") %]"
+mkdir -p "$destdir"
+[% IF c("var/ncdns-android-armv7") -%]
+  mv [% c('input_files_by_name/android-armv7') %]/* "$destdir"/
+[% END -%]
+[% IF c("var/ncdns-android-x86") -%]
+  mv [% c('input_files_by_name/android-x86') %]/* "$destdir"/
+[% END -%]
+[% IF c("var/ncdns-android-x86_64") -%]
+  mv [% c('input_files_by_name/android-x86_64') %]/* "$destdir"/
+[% END -%]
+[% IF c("var/ncdns-android-aarch64") -%]
+  mv [% c('input_files_by_name/android-aarch64') %]/* "$destdir"/
+[% END -%]
+[% IF c("var/ncdns-windows-i686") -%]
+  mv [% c('input_files_by_name/windows-i686') %]/* "$destdir"/
+  mv [% c('input_files_by_name/windows-expert-bundle') %]/* "$destdir"/
+[% END -%]
+[% IF c("var/ncdns-windows-x86_64") -%]
+  mv [% c('input_files_by_name/windows-x86_64') %]/* "$destdir"/
+  mv [% c('input_files_by_name/windows64-expert-bundle') %]/* "$destdir"/
+[% END -%]
+[% IF c("var/ncdns-osx-x86_64") -%]
+  mv [% c('input_files_by_name/osx-x86_64') %]/* "$destdir"/
+[% END -%]
+[% IF c("var/ncdns-linux-i686") -%]
+  mv [% c('input_files_by_name/linux-i686') %]/* "$destdir"/
+[% END -%]
+[% IF c("var/ncdns-linux-x86_64") -%]
+  mv [% c('input_files_by_name/linux-x86_64') %]/* "$destdir"/
+[% END -%]
+cd "$destdir"
+cat > .htaccess <<EOF
+RewriteEngine On
+RewriteRule ^sha256sums.txt$ sha256sums-unsigned-build.txt
+RewriteRule ^sha256sums.txt.asc$ sha256sums-unsigned-build.txt.asc
+RewriteRule ^sha256sums.incrementals.txt$ sha256sums-unsigned-build.incrementals.txt
+RewriteRule ^sha256sums.incrementals.txt.asc$ sha256sums-unsigned-build.incrementals.txt.asc
+EOF
+sha256sum $(ls -1 *.exe *.tar.xz *.dmg *.mar *.zip *.tar.gz *.apk *.json | grep -v '\.incremental\.mar$' | sort) > sha256sums-unsigned-build.txt
+[% IF c("var/sign_build") -%]
+  gpg -abs [% c("var/sign_build_gpg_opts") %] sha256sums-unsigned-build.txt
+[% END -%]
+cat sha256sums-unsigned-build.txt
diff --git a/projects/release/config b/projects/release/config
new file mode 100644
index 0000000..2d542e0
--- /dev/null
+++ b/projects/release/config
@@ -0,0 +1,184 @@
+# vim: filetype=yaml sw=2
+version: '[% c("var/ncdns_version") %]'
+output_dir: release
+
+var:
+  signed_status: unsigned
+  publish_dir: '[% c("var/signed_status") %]/[% c("version") %]-[% c("var/ncdns_build") %]'
+  containers_target: with_containers
+
+targets:
+  ncdns-all:
+    - ncdns-linux-x86_64
+    - ncdns-linux-i686
+    - ncdns-windows-i686
+    - ncdns-windows-x86_64
+    - ncdns-osx-x86_64
+    #- ncdns-android-armv7
+    #- ncdns-android-x86
+    #- ncdns-android-x86_64
+    #- ncdns-android-aarch64
+    - ncdns-src
+  ncdns-all-desktop:
+    - ncdns-linux-x86_64
+    - ncdns-linux-i686
+    - ncdns-windows-i686
+    - ncdns-windows-x86_64
+    - ncdns-osx-x86_64
+    - ncdns-src
+  ncdns-all-android:
+    - ncdns-android-armv7
+    - ncdns-android-x86
+    - ncdns-android-x86_64
+    - ncdns-android-aarch64
+  ncdns-android-armv7:
+    var:
+      ncdns-android-armv7: 1
+  ncdns-android-x86:
+    var:
+      ncdns-android-x86: 1
+  ncdns-android-x86_64:
+    var:
+      ncdns-android-x86_64: 1
+  ncdns-android-aarch64:
+    var:
+      ncdns-android-aarch64: 1
+  ncdns-linux-x86_64:
+    var:
+      ncdns-linux-x86_64: 1
+  ncdns-linux-x86_64-asan:
+    var:
+      ncdns-linux-x86_64: 1
+      asan-build: '-asan'
+  ncdns-linux-i686:
+    var:
+      ncdns-linux-i686: 1
+  ncdns-windows-i686:
+    var:
+      ncdns-windows-i686: 1
+  ncdns-windows-x86_64:
+    var:
+      ncdns-windows-x86_64: 1
+  ncdns-osx-x86_64:
+    var:
+      ncdns-osx-x86_64: 1
+  ncdns-src:
+    var:
+      ncdns-src: '[% ! c("var/testbuild") %]'
+  ncdns-src-testbuild:
+    var:
+      ncdns-src: 1
+
+  notarget:
+    - release
+    - ncdns-all
+    #- ncdns-all-android
+    - ncdns-all-desktop
+
+  noversiondir:
+    var:
+      publish_dir: ''
+
+  release:
+    var:
+      build_target: release
+
+  nightly:
+    output_dir: 'nightly'
+    var:
+      build_target: nightly
+      publish_dir: '[% c("version") %]'
+
+  alpha:
+    output_dir: alpha
+    var:
+      build_target: alpha
+
+  testbuild:
+    output_dir: 'testbuild'
+    var:
+      testbuild: 1
+      build_target: ncdns-testbuild
+      publish_dir: ''
+
+  no_containers:
+    var:
+      containers_target: no_containers
+
+  signed:
+    var:
+      signed_status: signed
+
+  create_unsigned_incrementals:
+    var:
+      create_unsigned_incrementals: 1
+
+input_files:
+
+# Release
+ - name: android-armv7
+   project: plain-binaries
+   enable: '[% c("var/ncdns-android-armv7") %]'
+   target:
+     - '[% c("var/containers_target") %]'
+     - '[% c("var/build_target") %]'
+     - ncdns-android-armv7
+
+ - name: android-x86
+   project: plain-binaries
+   enable: '[% c("var/ncdns-android-x86") %]'
+   target:
+     - '[% c("var/containers_target") %]'
+     - '[% c("var/build_target") %]'
+     - ncdns-android-x86
+
+ - name: android-x86_64
+   project: plain-binaries
+   enable: '[% c("var/ncdns-android-x86_64") %]'
+   target:
+     - '[% c("var/containers_target") %]'
+     - '[% c("var/build_target") %]'
+     - ncdns-android-x86_64
+
+ - name: android-aarch64
+   project: plain-binaries
+   enable: '[% c("var/ncdns-android-aarch64") %]'
+   target:
+     - '[% c("var/containers_target") %]'
+     - '[% c("var/build_target") %]'
+     - ncdns-android-aarch64
+
+ - name: linux-x86_64
+   project: plain-binaries
+   enable: '[% c("var/ncdns-linux-x86_64") %]'
+   target:
+     - '[% c("var/build_target") %]'
+     - 'ncdns-linux-x86_64[% c("var/asan-build") %]'
+
+ - name: linux-i686
+   project: plain-binaries
+   enable: '[% c("var/ncdns-linux-i686") %]'
+   target:
+     - '[% c("var/build_target") %]'
+     - ncdns-linux-i686
+
+ - name: windows-i686
+   project: plain-binaries
+   enable: '[% c("var/ncdns-windows-i686") %]'
+   target:
+     - '[% c("var/build_target") %]'
+     - ncdns-windows-i686
+
+ - name: windows-x86_64
+   project: plain-binaries
+   enable: '[% c("var/ncdns-windows-x86_64") %]'
+   target:
+     - '[% c("var/build_target") %]'
+     - ncdns-windows-x86_64
+
+ - name: osx-x86_64
+   project: plain-binaries
+   enable: '[% c("var/ncdns-osx-x86_64") %]'
+   target:
+     - '[% c("var/build_target") %]'
+     - ncdns-osx-x86_64
diff --git a/tools/cirrus_gen_yml.sh b/tools/cirrus_gen_yml.sh
index 90cf27b..7d53b13 100755
--- a/tools/cirrus_gen_yml.sh
+++ b/tools/cirrus_gen_yml.sh
@@ -29,7 +29,7 @@ print_os_arch () {
     echo ""
 
     # TODO fine-tune this list
-    for PROJECT in goeasyconfig ncdns ncp11 ncprop279 plain-binaries; do
+    for PROJECT in goeasyconfig ncdns ncp11 ncprop279 plain-binaries release; do
         echo "${CHANNEL}_${OS}_${ARCH}_${PROJECT}_docker_builder:
   timeout_in: 120m
   out_${CHANNEL}_${OS}_${ARCH}_cache: