diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
new file mode 100644
--- /dev/null
+++ b/.github/workflows/release-binaries.yml
@@ -0,0 +1,116 @@
+name: Release Binaries
+
+on:
+  push:
+    tags:
+      - 'llvmorg-*'
+  workflow_dispatch:
+    inputs:
+      upload:
+        description: 'Upload binaries to the release page'
+        required: true
+        default: true
+        type: boolean
+      tag:
+        description: 'Tag to build'
+        required: true
+        type: string
+
+permissions:
+  contents: read # Default everything to read-only
+
+jobs:
+  prepare:
+    name: Prepare to build binaries
+    runs-on: ubuntu-22.04
+    if: github.repository == 'llvm/llvm-project'
+    outputs:
+      release-version: ${{ steps.validate-tag.outputs.release-version }}
+      release: ${{ steps.validate-tag.outputs.release }}
+      build-dir: ${{ steps.validate-tag.outputs.build-dir }}
+      rc-flags: ${{ steps.validate-tag.outputs.rc-flags }}
+      ref: ${{ steps.validate-tag.outputs.ref }}
+
+    steps:
+    - name: Checkout LLVM
+      uses: actions/checkout@v3
+
+    - name: Validate and parse tag
+      id: validate-tag
+      # In order for the test-release.sh script to run correctly, the LLVM
+      # source needs to be at the following location relative to the build dir:
+      # | X.Y.Z-rcN | ./rcN/llvm-project
+      # | X.Y.Z     | ./final/llvm-project
+      #
+      # We also need to set divergent flags based on the release version:
+      # | X.Y.Z-rcN | -rc N -test-asserts
+      # | X.Y.Z     | -final
+      run: |
+        if [ -n "${{ inputs.tag }}" ]; then
+          tag="${{ inputs.tag }}"
+        else
+          tag="${{ github.ref_name }}"
+        fi
+
+        if [ -n "${{ inputs.upload }}" ]; then
+          upload="${{ inputs.upload }}"
+        else
+          upload="true"
+        fi
+        bash .github/workflows/set-release-binary-outputs.sh "${{ github.actor }}" "$tag" "$upload"
+
+  build-binaries:
+    name: ${{ matrix.target.triple }}
+    permissions:
+      contents: write # To upload assets to release.
+    needs: prepare
+    runs-on: ${{ matrix.target.runs-on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - triple: x86_64-linux-gnu-ubuntu-22.04
+            runs-on: ubuntu-22.04-8x32
+            debian-build-deps: >
+              chrpath
+              gcc-multilib
+              ninja-build
+
+    steps:
+    - name: Checkout LLVM
+      uses: actions/checkout@v3
+      with:
+        ref: ${{ needs.prepare.outputs.ref }}
+        path: ${{ needs.prepare.outputs.build-dir }}/llvm-project
+
+    - name: Install Brew build dependencies
+      if: matrix.target.brew-build-deps != ''
+      run: brew install ${{ matrix.target.brew-build-deps }}
+
+    - name: Install Debian build dependencies
+      if: matrix.target.debian-build-deps != ''
+      run: sudo apt install ${{ matrix.target.debian-build-deps }}
+
+    - name: Set macOS build env variables
+      if: runner.os == 'macOS'
+      run: |
+        echo "MACOSX_DEPLOYMENT_TARGET=10.9" >> $GITHUB_ENV
+
+    - name: Build and test release
+      run: |
+        ${{ needs.prepare.outputs.build-dir }}/llvm-project/llvm/utils/release/test-release.sh \
+        -release ${{ needs.prepare.outputs.release }} \
+        ${{ needs.prepare.outputs.rc-flags }} \
+        -triple ${{ matrix.target.triple }} \
+        -use-ninja \
+        -no-checkout \
+        -no-test-suite
+
+    - name: Upload binaries
+      if: ${{ always() && needs.prepare.outputs.upload == 'true' }}
+      run: |
+        ${{ needs.prepare.outputs.build-dir }}/llvm-project/llvm/utils/release/github-upload-release.py \
+        --token ${{ github.token }} \
+        --release ${{ needs.prepare.outputs.release-version }} \
+        upload \
+        --files ${{ needs.prepare.outputs.build-dir }}/clang+llvm-${{ needs.prepare.outputs.release-version }}-${{ matrix.target.triple }}.tar.xz
diff --git a/.github/workflows/set-release-binary-outputs.sh b/.github/workflows/set-release-binary-outputs.sh
new file mode 100644
--- /dev/null
+++ b/.github/workflows/set-release-binary-outputs.sh
@@ -0,0 +1,34 @@
+# Usage: set-release-binary-outputs.sh <github_user> <tag> <upload>
+
+set -e
+
+if [ -z "$GITHUB_OUTPUT" ]; then
+  export GITHUB_OUTPUT=`mktemp`
+  echo "Warning: Environment variable GITHUB_OUTPUT is not set."
+  echo "Writing output variables to $GITHUB_OUTPUT"
+fi
+
+github_user=$1
+tag=$2
+upload=$3
+
+if [[ "$github_user" != "tstellar" && "$github_user" != "tru" ]]; then
+  echo "ERROR: User not allowed: $github_user"
+  exit 1
+fi
+pattern='^llvmorg-[0-9]\+\.[0-9]\+\.[0-9]\+\(-rc[0-9]\+\)\?$'
+echo "$tag" | grep -e $pattern
+if [ $? != 0 ]; then
+  echo "ERROR: Tag '$tag' doesn't match pattern: $pattern"
+  exit 1
+fi
+release_version=`echo "$tag" | sed 's/llvmorg-//g'`
+release=`echo "$release_version" | sed 's/-.*//g'`
+build_dir=`echo "$release_version" | sed 's,^[^-]\+,final,' | sed 's,[^-]\+-rc\(.\+\),rc\1,'`
+rc_flags=`echo "$release_version" | sed 's,^[^-]\+,-final,' | sed 's,[^-]\+-rc\(.\+\),-rc \1 -test-asserts,' | sed 's,--,-,'`
+echo "release-version=$release_version" >> $GITHUB_OUTPUT
+echo "release=$release" >> $GITHUB_OUTPUT
+echo "build-dir=$build_dir" >> $GITHUB_OUTPUT
+echo "rc-flags=$rc_flags" >> $GITHUB_OUTPUT
+echo "upload=$upload" >> $GITHUB_OUTPUT
+echo "ref=$tag" >> $GITHUB_OUTPUT