diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 504d224e..43fc553f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,9 +17,6 @@ jobs:
   create-release:
     name: create-release
     runs-on: ubuntu-latest
-    # env:
-      # Set to force version number, e.g., when no tag exists.
-      # VERSION: TEST-0.0.0
     steps:
       - uses: actions/checkout@v4
       - name: Get the release version from the tag
@@ -28,6 +25,13 @@ jobs:
       - name: Show the version
         run: |
           echo "version is: $VERSION"
+      - name: Check that tag version and Cargo.toml version are the same
+        shell: bash
+        run: |
+          if ! grep -q "version = \"$VERSION\"" Cargo.toml; then
+            echo "version does not match Cargo.toml" >&2
+            exit 1
+          fi
       - name: Create GitHub release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -259,3 +263,89 @@ jobs:
       run: |
         version="${{ needs.create-release.outputs.version }}"
         gh release upload "$version" ${{ env.ASSET }} ${{ env.ASSET_SUM }}
+
+  build-release-deb:
+    name: build-release-deb
+    needs: ['create-release']
+    runs-on: ubuntu-latest
+    env:
+      TARGET: x86_64-unknown-linux-musl
+      # Emit backtraces on panics.
+      RUST_BACKTRACE: 1
+      # Since we're distributing the dpkg, we don't know whether the user will
+      # have PCRE2 installed, so just do a static build.
+      PCRE2_SYS_STATIC: 1
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Install packages (Ubuntu)
+      shell: bash
+      run: |
+        ci/ubuntu-install-packages
+
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@master
+      with:
+        toolchain: nightly
+        target: ${{ env.TARGET }}
+
+    - name: Install cargo-deb
+      shell: bash
+      run: |
+        cargo install cargo-deb
+
+    # 'cargo deb' does not seem to provide a way to specify an asset that is
+    # created at build time, such as ripgrep's man page. To work around this,
+    # we force a debug build, copy out the man page (and shell completions)
+    # produced from that build, put it into a predictable location and then
+    # build the deb, which knows where to look.
+    - name: Build debug binary to create release assets
+      shell: bash
+      run: |
+        cargo build --target ${{ env.TARGET }}
+        bin="target/${{ env.TARGET }}/debug/rg"
+        echo "BIN=$bin" >> $GITHUB_ENV
+
+    - name: Create deployment directory
+      shell: bash
+      run: |
+        dir=deployment/deb
+        mkdir -p "$dir"
+        echo "DEPLOY_DIR=$dir" >> $GITHUB_ENV
+
+    - name: Generate man page
+      shell: bash
+      run: |
+        "$BIN" --generate man > "$DEPLOY_DIR/rg.1"
+
+    - name: Generate shell completions
+      shell: bash
+      run: |
+        "$BIN" --generate complete-bash > "$DEPLOY_DIR/rg.bash"
+        "$BIN" --generate complete-fish > "$DEPLOY_DIR/rg.fish"
+        "$BIN" --generate complete-zsh > "$DEPLOY_DIR/_rg"
+
+    - name: Build release binary
+      shell: bash
+      run: |
+        cargo deb --profile deb --target ${{ env.TARGET }}
+        version="${{ needs.create-release.outputs.version }}"
+        deb="target/${{ env.TARGET }}/debian/ripgrep_$version-1_amd64.deb"
+        echo "DEB=$deb" >> $GITHUB_ENV
+
+    - name: Create sha256 sum of deb file
+      shell: bash
+      run: |
+        sum="$DEB.sha256"
+        shasum -a 256 "$DEB" > "$sum"
+        echo "SUM=$sum" >> $GITHUB_ENV
+
+    - name: Upload release archive
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      shell: bash
+      run: |
+        version="${{ needs.create-release.outputs.version }}"
+        gh release upload "$version" ${{ env.DEB }} ${{ env.SUM }}
diff --git a/Cargo.toml b/Cargo.toml
index 457f1d83..90c6ae85 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -74,6 +74,13 @@ pcre2 = ["grep/pcre2"]
 [profile.release]
 debug = 1
 
+# This is the main way to strip binaries in the deb package created by
+# 'cargo deb'. For other release binaries, we (currently) call 'strip'
+# explicitly in the release process.
+[profile.deb]
+inherits = "release"
+debug = false
+
 [package.metadata.deb]
 features = ["pcre2"]
 section = "utils"