diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b2f7a0df..38c671c2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,15 +50,18 @@ jobs:
       run: |
         _out/e2e.test -ginkgo.focus='\[PositiveFlow\]'
 
+    - name: render manifests
+      run: |
+        make release-manifests-k8s
+
     - name: fix build artifacts
       run: |
-        mv _out/deployer deployer-${{ env.RELEASE_VERSION }}-linux-amd64
-        make clean outdir
-        mv deployer-${{ env.RELEASE_VERSION}}-linux-amd64 _out/
+        cp _out/deployer _out/deployer-${{ env.RELEASE_VERSION }}-linux-amd64
+        cp _out/deployer-manifests-allinone.yaml _out/deployer-manifests-allinone-${{ env.RELEASE_VERSION }}.yaml
 
     - name: compute signature
       run: |
-        pushd _out && sha256sum * >> ../SHA256SUMS && mv ../SHA256SUMS . && popd
+        hack/make-checksum.sh ${{ env.RELEASE_VERSION }}
 
     - name: upload build artifacts
       uses: actions/upload-artifact@v2
diff --git a/Makefile b/Makefile
index 1ccdf94d..27088cdd 100644
--- a/Makefile
+++ b/Makefile
@@ -34,6 +34,10 @@ deployer: outdir update-version
 outdir:
 	@mkdir -p _out || :
 
+.PHONY: release-manifests
+release-manifests-k8s: deployer
+	@_out/deployer -P kubernetes render > _out/deployer-manifests-allinone.yaml
+
 .PHONY: test-unit
 test-unit:
 	go test ./pkg/...
diff --git a/hack/make-checksum.sh b/hack/make-checksum.sh
new file mode 100755
index 00000000..867a6036
--- /dev/null
+++ b/hack/make-checksum.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -eu
+
+VERSION="${1}"
+FILES="
+deployer-${VERSION}-linux-amd64
+deployer-manifests-allinone-${VERSION}.yaml
+"
+
+for artifact in $FILES; do
+	if [ ! -f "_out/${artifact}" ]; then
+		echo "MISSING: ${artifact}" >&2
+		exit 1
+	fi
+done
+
+pushd _out
+:> SHA256SUMS
+sha256sum ${FILES} >> SHA256SUMS
+popd