diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9ee9a5b4..965d87d6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,6 +20,7 @@ jobs:
           ./configure --with-standalone --bindir=/
           make DESTDIR=. install-exec
           echo VERSION=$(cat .version) >> $GITHUB_ENV
+          sha256sum vcsh-standalone.sh
       - name: Post standalone script artifact
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cf45cf38..8da056b2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,6 +43,7 @@ jobs:
           files: |
             vcsh-${{ env.VERSION }}.tar.zst
             vcsh-${{ env.VERSION }}.zip
+            vcsh-${{ env.VERSION }}.sha256.txt
 
   deploy-standalone:
     runs-on: ubuntu-latest
@@ -56,9 +57,11 @@ jobs:
           ./bootstrap.sh
           ./configure --with-standalone --bindir=/
           make DESTDIR=. install-exec
+          sha256sum vcsh-standalone.sh | tee vcsh-standalone.sha256.txt
       - name: Add standalone deployment to release
         uses: svenstaro/upload-release-action@v2
         with:
           repo_token: ${{ github.token }}
-          file: vcsh-standalone.sh
           tag: ${{ github.ref }}
+          file_glob: true
+          file: vcsh-standalone.{sh,sha256.txt}
diff --git a/Makefile.am b/Makefile.am
index 87e69aaa..c4e1fb82 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -24,6 +24,7 @@ BUILT_SOURCES =
 CLEANFILES = $(dist_man_MANS) $(bin_SCRIPTS)
 
 include $(top_srcdir)/build-aux/git_version.mk
+include $(top_srcdir)/build-aux/dist_checksums.mk
 include $(top_srcdir)/build-aux/shell_completion_dirs.mk
 
 if !IS_SDIST
diff --git a/build-aux/ax_dist_checksums.m4 b/build-aux/ax_dist_checksums.m4
new file mode 100644
index 00000000..5df751c9
--- /dev/null
+++ b/build-aux/ax_dist_checksums.m4
@@ -0,0 +1,6 @@
+AC_DEFUN([AX_DIST_CHECKSUMS], [
+
+        AX_PROGVAR([sha256sum])
+        AX_PROGVAR([tee])
+
+])
diff --git a/build-aux/dist_checksums.mk b/build-aux/dist_checksums.mk
new file mode 100644
index 00000000..16e4dd08
--- /dev/null
+++ b/build-aux/dist_checksums.mk
@@ -0,0 +1,13 @@
+# Output both a file that can be attatched to releases and also write STDOUT
+# for the sake of CI build logs so they can be audited as matching what is
+# eventually posted. The list of files checksummed is a glob (even though we
+# know an exact pattern) to avoid errors for formats not generated.
+checksum_dist = \
+	shopt -s nullglob ; \
+	$(SHA256SUM) $(distdir)*.{tar.{gz,bz2,lz,xz,zst},zip} |\
+		$(TEE) $(distdir).sha256.txt
+
+CLEANFILES += $(distdir).sha256.txt
+
+# Append checksum operation to function that runs after compressing dist archives
+am__post_remove_distdir = $(am__remove_distdir); $(checksum_dist)
diff --git a/configure.ac b/configure.ac
index b9b1d24c..3825494a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -28,9 +28,10 @@ AC_ARG_WITH([standalone],
             ],
             [])
 
-# These three macros must be run after processing our standalone setup because
+# These macros must be run after processing our standalone setup because
 # they all expect the program name transformation setup to be complete.
 AX_GIT_VERSION
+AX_DIST_CHECKSUMS
 AX_SHELL_COMPLETION_DIRS
 AX_TRANSFORM_PACKAGE_NAME