diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 35036ac..de336c7 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,62 +13,84 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     needs: test
+    env:
+      ARTIFACT_DIR: artifact
+    outputs:
+      sha256: ${{ steps.gen_sha256.outputs.sha256 }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: stable
+        uses: dtolnay/rust-toolchain@stable
       - name: Install dependencies
         run: sudo apt-get install libnl-3-dev libnl-genl-3-dev libnl-route-3-dev libpulse-dev
       - name: Build
         run: cargo build --release --locked
-      - name: Upload binary artifact
-        uses: actions/upload-artifact@v3
+      - name: Prepare artifact
+        run: |
+          mkdir $ARTIFACT_DIR
+          mv -f target/release/baru $ARTIFACT_DIR/
+      - name: Gen sha256
+        id: gen_sha256
+        working-directory: ${{ env.ARTIFACT_DIR }}
+        run: |
+          sha256=$(sha256sum baru)
+          echo "$sha256"
+          echo "sha256=$sha256" >> "$GITHUB_OUTPUT"
+          echo "$sha256" > baru.sha256sum
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
         with:
           name: baru
-          path: ./target/release/baru
+          path: ${{ env.ARTIFACT_DIR }}
+          retention-days: 2
 
-  gh-release:
-    name: Publish Github Release
+  release:
+    name: Release
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      SHA256: ${{ needs.build.outputs.sha256 }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
       - name: Download binary artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: baru
-          path: ./target/release/
-      - name: Release
-        uses: softprops/action-gh-release@v1
+      - name: Integrity check
+        run: |
+          sha256sum -c baru.sha256sum
+          [ "$SHA256" == "$(cat baru.sha256sum)" ] && echo "sha256 OK"
+      - name: Create release
+        uses: softprops/action-gh-release@v2
         with:
-          files: target/release/baru
+          files: |
+            baru
+            baru.sha256sum
 
   aur-packaging:
     name: Publish AUR package
-    needs: gh-release
+    needs: release
     runs-on: ubuntu-latest
     env:
-      PKG_NAME: baru
+      PKGNAME: baru
       PKGBUILD: ./.pkg/aur/PKGBUILD
       RELEASE_TAG: ${{ github.ref_name }}
       REPOSITORY: ${{ github.repository }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Download sources
-        run: curl -LfsSo "$PKG_NAME-$RELEASE_TAG".tar.gz "https://github.com/$REPOSITORY/archive/refs/tags/$RELEASE_TAG.tar.gz"
+        run: curl -LfsSo "$PKGNAME-$RELEASE_TAG".tar.gz "https://github.com/$REPOSITORY/archive/refs/tags/$RELEASE_TAG.tar.gz"
       - name: Update PKGBUILD
         run: ./.pkg/aur/update.sh
       - name: Show PKGBUILD
         run: cat "$PKGBUILD"
       - name: Publish
-        uses: KSXGitHub/github-actions-deploy-aur@v2.6.0
+        uses: KSXGitHub/github-actions-deploy-aur@v2.7.2
         with:
-          pkgname: ${{ env.PKG_NAME }}
+          pkgname: ${{ env.PKGNAME }}
           pkgbuild: ${{ env.PKGBUILD }}
           commit_username: ${{ secrets.AUR_USERNAME }}
           commit_email: ${{ secrets.AUR_EMAIL }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 27ac0ed..8eafb10 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,11 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@stable
         with:
-          toolchain: stable
           components: clippy
       - name: Install dependencies
         run: sudo apt-get install libnl-3-dev libnl-genl-3-dev libnl-route-3-dev libpulse-dev
diff --git a/.pkg/aur/PKGBUILD b/.pkg/aur/PKGBUILD
index 13889f1..14b709a 100644
--- a/.pkg/aur/PKGBUILD
+++ b/.pkg/aur/PKGBUILD
@@ -11,6 +11,7 @@ depends=('libpulse')
 makedepends=('rust' 'cargo')
 provides=('baru')
 conflicts=('baru')
+options=(!debug)
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
 sha256sums=('xxx')
 
diff --git a/.pkg/aur/update.sh b/.pkg/aur/update.sh
index 471f9bd..6a42d99 100755
--- a/.pkg/aur/update.sh
+++ b/.pkg/aur/update.sh
@@ -14,8 +14,8 @@ if [ -z "$PKGBUILD" ]; then
   exit 1
 fi
 
-if [ -z "$PKG_NAME" ]; then
-  >&2 printf "  %b%b✕%b PKG_NAME not set\n" "$red" "$bold" "$reset"
+if [ -z "$PKGNAME" ]; then
+  >&2 printf "  %b%b✕%b PKGNAME not set\n" "$red" "$bold" "$reset"
   exit 1
 fi
 
@@ -35,7 +35,7 @@ if ! [[ "$RELEASE_TAG" =~ ^v.*? ]]; then
 fi
 
 pkgver="${RELEASE_TAG#v}"
-tarball="$PKG_NAME-$RELEASE_TAG".tar.gz
+tarball="$PKGNAME-$RELEASE_TAG".tar.gz
 
 if ! [ -a "$tarball" ]; then
   >&2 printf "  %b%b✕%b no such file $tarball\n" "$red" "$bold" "$reset"