diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..ed763f96
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,24 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    permissions:
+      contents: write
+    uses: owncloud/reusable-workflows/.github/workflows/release.yml@main
+    with:
+      app-name: notes
+      # notes emits two tarballs both named notes.tar.gz (source and appstore);
+      # publish only the appstore one, otherwise the release assets collide.
+      artifact-glob: build/artifacts/appstore/*.tar.gz
+    secrets:
+      SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+      SIGNING_CERT: ${{ secrets.SIGNING_CERT }}
+      SIGNING_CHAIN: ${{ secrets.SIGNING_CHAIN }}
diff --git a/Makefile b/Makefile
index 67a5ed3d..5ccdadfd 100644
--- a/Makefile
+++ b/Makefile
@@ -72,7 +72,6 @@ endif
 # * the certificate is located in ~/.owncloud/notes.crt
 occ=$(CURDIR)/../../occ
 phpunit_oc10=$(CURDIR)/../../lib/composer/bin/phpunit
-configdir=$(CURDIR)/../../config
 private_key=$(HOME)/.owncloud/certificates/$(app_name).key
 certificate=$(HOME)/.owncloud/certificates/$(app_name).crt
 sign=php -f $(occ) integrity:sign-app --privateKey="$(private_key)" --certificate="$(certificate)"
@@ -168,9 +167,7 @@ appstore: build
 	"CHANGELOG.md" \
 	$(appstore_build_directory)
 ifdef CAN_SIGN
-	mv $(configdir)/config.php $(configdir)/config-2.php
 	$(sign) --path="$(appstore_build_directory)"
-	mv $(configdir)/config-2.php $(configdir)/config.php
 else
 	@echo $(sign_skip_msg)
 endif