diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index f2dcc3ae96..41defedd00 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -122,6 +122,27 @@ jobs:
         LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}
         AZURE_BLOBSTORE_TOKEN: ${{ secrets.AZURE_BLOBSTORE_TOKEN }}
 
+  keeper:
+    name: Keeper Build
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: 1.24
+        cache: false
+
+    - name: Install cross toolchain
+      run: |
+        apt-get update
+        apt-get -yq --no-install-suggests --no-install-recommends install gcc-multilib
+
+    - name: Build (amd64)
+      run: |
+        go run build/ci.go keeper -dlgo
+
   windows:
     name: Windows Build
     runs-on: "win-11"
diff --git a/build/ci.go b/build/ci.go
index 500e204b68..f60ac6e59c 100644
--- a/build/ci.go
+++ b/build/ci.go
@@ -31,6 +31,8 @@ Available commands are:
 	install    [ -arch architecture ] [ -cc compiler ] [ packages... ] -- builds packages and executables
 	test       [ -coverage ] [ packages... ]                           -- runs the tests
 
+	install-keeper [ -dlgo ]
+
 	archive    [ -arch architecture ] [ -type zip|tar ] [ -signer key-envvar ] [ -signify key-envvar ] [ -upload dest ] -- archives build artifacts
 	importkeys                                                                                  -- imports signing keys from env
 	debsrc     [ -signer key-id ] [ -upload dest ]                                              -- creates a debian source package
@@ -80,6 +82,33 @@ var (
 		executablePath("clef"),
 	}
 
+	keeperArchiveFiles = []string{
+		"COPYING",
+		executablePath("keeper"),
+	}
+
+	keeperTargets = []struct {
+		Name   string
+		GOOS   string
+		GOARCH string
+		CC     string
+		Tags   string
+		Env    map[string]string
+	}{
+		{
+			Name:   "ziren",
+			GOOS:   "linux",
+			GOARCH: "mipsle",
+			CC:     "mipsel-linux-gnu-gcc",
+			Tags:   "ziren",
+			Env:    map[string]string{"GOMIPS": "softfloat"},
+		},
+		{
+			Name: "example",
+			Tags: "example",
+		},
+	}
+
 	// A debian package is created for all executables listed here.
 	debExecutables = []debExecutable{
 		{
@@ -172,6 +201,8 @@ func main() {
 		doPurge(os.Args[2:])
 	case "sanitycheck":
 		doSanityCheck()
+	case "keeper":
+		doInstallKeeper(os.Args[2:])
 	default:
 		log.Fatal("unknown command ", os.Args[1])
 	}
@@ -244,6 +275,38 @@ func doInstall(cmdline []string) {
 	}
 }
 
+// doInstallKeeper builds keeper binaries for all supported targets.
+func doInstallKeeper(cmdline []string) {
+	var dlgo = flag.Bool("dlgo", false, "Download Go and build with it")
+
+	flag.CommandLine.Parse(cmdline)
+	env := build.Env()
+
+	for _, target := range keeperTargets {
+		log.Printf("Building keeper for %s/%s (tags: %s)", target.GOOS, target.GOARCH, target.Tags)
+
+		// Configure the toolchain.
+		tc := build.GoToolchain{GOARCH: target.GOARCH, GOOS: target.GOOS, CC: target.CC}
+		if *dlgo {
+			csdb := download.MustLoadChecksums("build/checksums.txt")
+			tc.Root = build.DownloadGo(csdb)
+		}
+
+		gobuild := tc.Go("build", buildFlags(env, true, []string{target.Tags})...)
+		gobuild.Args = append(gobuild.Args, "-trimpath", "-v")
+
+		for key, value := range target.Env {
+			gobuild.Env = append(gobuild.Env, key+"="+value)
+		}
+		outputName := fmt.Sprintf("keeper-%s", target.Name)
+
+		args := slices.Clone(gobuild.Args)
+		args = append(args, "-o", executablePath(outputName))
+		args = append(args, "./cmd/keeper")
+		build.MustRun(&exec.Cmd{Path: gobuild.Path, Args: args, Env: gobuild.Env})
+	}
+}
+
 // buildFlags returns the go tool flags for building.
 func buildFlags(env build.Environment, staticLinking bool, buildTags []string) (flags []string) {
 	var ld []string