diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
index 741edf1..01db531 100644
--- a/.github/workflows/kernel-build.yml
+++ b/.github/workflows/kernel-build.yml
@@ -11,17 +11,21 @@ concurrency:
 
 permissions: {}
 
-env:
-  GH_REPO: ${{ github.repository }}
-  GH_TOKEN: ${{ secrets.VARS_TOKEN }}
+defaults:
+  run:
+    shell: bash
 
 jobs:
   kernel-build:
     runs-on: ubuntu-26.04
     environment: Build
+    permissions:
+      contents: write # required to push new releases
     steps:
       - name: Read env variables
         id: env_variables
+        env:
+          GH_TOKEN: ${{ secrets.VARS_TOKEN }} # has Environments RW
         run: |
           stored_upstream=$(gh variable get UPSTREAM_KERNEL_VERSION --env Build)
           stored_secureblue_buildid_version="$(gh variable get SECUREBLUE_BUILDID_VERSION --env Build)"
@@ -67,13 +71,39 @@ jobs:
           echo "secureblue_buildid_version=${secureblue_buildid_version}" >> "${GITHUB_OUTPUT}"
 
       - name: Run build
+        id: build
+        timeout-minutes: 120
         if: steps.calculate_buildid.outputs.need_build == 'true'
         env:
+          GH_TOKEN: ${{ secrets.VARS_TOKEN }} # has Environments RW
           CURRENT_UPSTREAM_VERSION_PLUS_RELEASE: ${{ steps.get_upstream_version.outputs.current_upstream_version_plus_release }}
           SECUREBLUE_BUILDID_VERSION: ${{ steps.calculate_buildid.outputs.secureblue_buildid_version }}
           COPR_WEBHOOK_URL: ${{ secrets.COPR_WEBHOOK_URL }}
         run: |
+          payload=$(jq -cn --arg buildid_version "${SECUREBLUE_BUILDID_VERSION}" '{"secureblue_buildid_version": $buildid_version | tonumber}')
           gh variable set UPSTREAM_KERNEL_VERSION --env Build --body "${CURRENT_UPSTREAM_VERSION_PLUS_RELEASE}"
           gh variable set SECUREBLUE_BUILDID_VERSION --env Build --body "${SECUREBLUE_BUILDID_VERSION}"
-          payload=$(jq -cn --arg buildid_version "${SECUREBLUE_BUILDID_VERSION}" '{"secureblue_buildid_version": $buildid_version | tonumber}')
-          curl -fLsS --retry 5 --json "${payload}" "${COPR_WEBHOOK_URL}"
+          build_id=$(curl -fLsS --retry 5 --json "${payload}" "${COPR_WEBHOOK_URL}")
+          while true; do
+            state=$(curl -fLsS --retry 5 "https://copr.fedorainfracloud.org/api_3/build/${BUILD_ID}" | jq -r '.state')
+            if [[ "${state}" == "succeeded" ]]; then
+              echo "build_succeeded=true" >> "${GITHUB_OUTPUT}"
+              exit 0
+            fi
+            
+            if [[ "${state}" =~ ^(canceled|skipped|failed)$ ]]; then
+              exit 1
+            fi
+            
+            sleep 60
+          done
+
+      - name: Create release
+        if: steps.build.outputs.success == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CURRENT_UPSTREAM_VERSION_PLUS_RELEASE: ${{ steps.get_upstream_version.outputs.current_upstream_version_plus_release }}
+          SECUREBLUE_BUILDID_VERSION: ${{ steps.calculate_buildid.outputs.secureblue_buildid_version }}
+        run: |
+          TAG="${CURRENT_UPSTREAM_VERSION_PLUS_RELEASE}.secureblue.${SECUREBLUE_BUILDID_VERSION}"
+          gh release create "${TAG}" --generate-notes