diff --git a/cmd/auth-proxy/.goreleaser.yaml b/cmd/auth-proxy/.goreleaser.yaml
new file mode 100644
index 0000000..3f49682
--- /dev/null
+++ b/cmd/auth-proxy/.goreleaser.yaml
@@ -0,0 +1,55 @@
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj
+# Generated by monorel (github.com/therootcompany/golib/tools/monorel)
+
+version: 2
+
+before:
+  hooks:
+    - go mod tidy
+    - go generate ./...
+
+builds:
+  - id: auth-proxy
+    binary: auth-proxy
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -s -w -X main.version={{.Env.VERSION}} -X main.commit={{.Commit}} -X main.date={{.Date}} -X main.builtBy=goreleaser
+    goos:
+      - linux
+      - windows
+      - darwin
+
+archives:
+  - id: auth-proxy
+    ids: [auth-proxy]
+    formats: [tar.gz]
+    # name_template uses VERSION env var so the prefixed monorepo tag
+    # doesn't appear in archive filenames.
+    name_template: >-
+      auth-proxy_{{ .Env.VERSION }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    format_overrides:
+      - goos: windows
+        formats: [tar.gz,zip]
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+
+checksum:
+  name_template: "auth-proxy_{{ .Env.VERSION }}_checksums.txt"
+  disable: false
+
+# Release is disabled: goreleaser Pro is required to publish with a
+# prefixed monorepo tag. We use 'gh release' instead (see release script).
+release:
+  disable: true