diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6450c93..4fae487 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -144,6 +144,13 @@ jobs:
           SCALANATIVE_MODE: release-fast
         run: sbt buildCliBinary
 
+      - name: Upload command line binaries
+        if: matrix.project == 'rootNative' && (matrix.scala == '3') && github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-bin-${{ matrix.os }}
+          path: modules/cli/native/target/bin/*
+
       - name: Run example (covers reading resources from a jar)
         if: matrix.project == 'rootJVM'
         run: sbt 'project ${{ matrix.project }}' '++ ${{ matrix.scala }}' example/run
@@ -276,11 +283,19 @@ jobs:
           SONATYPE_CREDENTIAL_HOST: ${{ secrets.SONATYPE_CREDENTIAL_HOST }}
         run: sbt tlCiRelease
 
+      - name: Download command line binaries
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: actions/download-artifact@v4
+        with:
+          pattern: cli-bin-*
+          path: target-cli/bin
+          merge-multiple: true
+
       - name: Upload release binaries
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@v1
         with:
-          files: modules/cli/native/target/bin/*
+          files: target-cli/bin/*
 
       - name: Release docker image
         if: startsWith(github.ref, 'refs/tags/')
@@ -289,7 +304,7 @@ jobs:
         run: |
           echo -n "${DOCKER_PASSWORD}" | docker login docker.io -u rolang --password-stdin
           export RELEASE_TAG=${GITHUB_REF_NAME#'v'}
-          cp -r modules/cli/native/target/bin docker-build/bin
+          cp -r target-cli/bin docker-build/bin
           docker build ./docker-build -t rolang/dumbo:${RELEASE_TAG}-alpine
           docker run rolang/dumbo:${RELEASE_TAG}-alpine
           docker tag rolang/dumbo:${RELEASE_TAG}-alpine rolang/dumbo:latest-alpine
diff --git a/build.sbt b/build.sbt
index ed0fbbe..f7a3553 100644
--- a/build.sbt
+++ b/build.sbt
@@ -23,10 +23,12 @@ ThisBuild / semanticdbEnabled := true
 ThisBuild / semanticdbVersion := scalafixSemanticdb.revision // use Scalafix compatible version
 
 // githubWorkflow
-ThisBuild / githubWorkflowOSes ++= Seq("macos-12", "macos-14")
-ThisBuild / githubWorkflowBuildMatrixExclusions ++= Seq(
-  MatrixExclude(Map("os" -> "macos-12", "project" -> "rootJVM")),
-  MatrixExclude(Map("os" -> "macos-14", "project" -> "rootJVM")),
+lazy val macOsArm   = "macos-14"
+lazy val macOsIntel = "macos-12"
+lazy val macOses    = Seq(macOsIntel, macOsArm)
+ThisBuild / githubWorkflowOSes ++= Seq(macOsIntel, macOsArm)
+ThisBuild / githubWorkflowBuildMatrixExclusions ++= macOses.map(os =>
+  MatrixExclude(Map("os" -> os, "project" -> "rootJVM"))
 )
 ThisBuild / githubWorkflowJavaVersions := Seq(JavaSpec.temurin("21"), JavaSpec.temurin("17"))
 ThisBuild / tlCiHeaderCheck            := true
@@ -46,8 +48,8 @@ ThisBuild / githubWorkflowBuildPreamble ++= Seq(
   )
 )
 ThisBuild / githubWorkflowBuildPreamble ++= List(
-  "macos-12" -> "/usr/local/opt",
-  "macos-14" -> "/opt/homebrew/opt",
+  macOsIntel -> "/usr/local/opt",
+  macOsArm   -> "/opt/homebrew/opt",
 ).map { case (os, llvmBase) =>
   WorkflowStep.Run(
     commands = List(
@@ -106,31 +108,48 @@ ThisBuild / githubWorkflowBuild ++= List(
   )
 }
 
-ThisBuild / githubWorkflowPublish += WorkflowStep.Use(
-  ref = UseRef.Public("softprops", "action-gh-release", "v1"),
-  name = Some("Upload release binaries"),
-  params = Map(
-    "files" -> "modules/cli/native/target/bin/*"
+ThisBuild / githubWorkflowBuild += WorkflowStep.Use(
+  ref = UseRef.Public("actions", "upload-artifact", "v4"),
+  params = Map("name" -> "cli-bin-${{ matrix.os }}", "path" -> "modules/cli/native/target/bin/*"),
+  name = Some("Upload command line binaries"),
+  cond = Some(
+    "matrix.project == 'rootNative' && (matrix.scala == '3') && github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')"
   ),
-  cond = Some("startsWith(github.ref, 'refs/tags/')"),
 )
 
-ThisBuild / githubWorkflowPublish += WorkflowStep.Run(
-  name = Some("Release docker image"),
-  commands = List(
-    """echo -n "${DOCKER_PASSWORD}" | docker login docker.io -u rolang --password-stdin""",
-    "export RELEASE_TAG=${GITHUB_REF_NAME#'v'}",
-    "cp -r modules/cli/native/target/bin docker-build/bin",
-    "docker build ./docker-build -t rolang/dumbo:${RELEASE_TAG}-alpine",
-    "docker run rolang/dumbo:${RELEASE_TAG}-alpine", // run for health-checking the docker image
-    "docker tag rolang/dumbo:${RELEASE_TAG}-alpine rolang/dumbo:latest-alpine",
-    "docker push rolang/dumbo:${RELEASE_TAG}-alpine",
-    "docker push rolang/dumbo:latest-alpine",
+// publish binaries and docker image
+ThisBuild / githubWorkflowPublish ++= Seq(
+  WorkflowStep.Use(
+    ref = UseRef.Public("actions", "download-artifact", "v4"),
+    params = Map("pattern" -> "cli-bin-*", "path" -> "target-cli/bin", "merge-multiple" -> "true"),
+    name = Some("Download command line binaries"),
+    cond = Some("startsWith(github.ref, 'refs/tags/')"),
   ),
-  env = Map(
-    "DOCKER_PASSWORD" -> "${{ secrets.DOCKER_PASSWORD }}"
+  WorkflowStep.Use(
+    ref = UseRef.Public("softprops", "action-gh-release", "v1"),
+    name = Some("Upload release binaries"),
+    params = Map(
+      "files" -> "target-cli/bin/*"
+    ),
+    cond = Some("startsWith(github.ref, 'refs/tags/')"),
+  ),
+  WorkflowStep.Run(
+    name = Some("Release docker image"),
+    commands = List(
+      """echo -n "${DOCKER_PASSWORD}" | docker login docker.io -u rolang --password-stdin""",
+      "export RELEASE_TAG=${GITHUB_REF_NAME#'v'}",
+      "cp -r target-cli/bin docker-build/bin",
+      "docker build ./docker-build -t rolang/dumbo:${RELEASE_TAG}-alpine",
+      "docker run rolang/dumbo:${RELEASE_TAG}-alpine", // run for health-checking the docker image
+      "docker tag rolang/dumbo:${RELEASE_TAG}-alpine rolang/dumbo:latest-alpine",
+      "docker push rolang/dumbo:${RELEASE_TAG}-alpine",
+      "docker push rolang/dumbo:latest-alpine",
+    ),
+    env = Map(
+      "DOCKER_PASSWORD" -> "${{ secrets.DOCKER_PASSWORD }}"
+    ),
+    cond = Some("startsWith(github.ref, 'refs/tags/')"),
   ),
-  cond = Some("startsWith(github.ref, 'refs/tags/')"),
 )
 
 ThisBuild / githubWorkflowBuild += WorkflowStep.Sbt(