diff --git a/.github/workflows/ci.generate.ts b/.github/workflows/ci.generate.ts
index 35020a5f8c55b8..b23223fb48d0f1 100755
--- a/.github/workflows/ci.generate.ts
+++ b/.github/workflows/ci.generate.ts
@@ -757,8 +757,10 @@ const ci = {
           ].join("\n"),
           run: [
             "cd target/release",
+            "shasum -a 256 deno > deno-${{ matrix.arch }}-unknown-linux-gnu.sha256sum",
             "zip -r deno-${{ matrix.arch }}-unknown-linux-gnu.zip deno",
             "strip denort",
+            "shasum -a 256 denort > denort-${{ matrix.arch }}-unknown-linux-gnu.sha256sum",
             "zip -r denort-${{ matrix.arch }}-unknown-linux-gnu.zip denort",
             "./deno types > lib.deno.d.ts",
           ].join("\n"),
@@ -783,8 +785,10 @@ const ci = {
             "--p12-file=<(echo $APPLE_CODESIGN_KEY | base64 -d) " +
             "--entitlements-xml-file=cli/entitlements.plist",
             "cd target/release",
+            "shasum -a 256 deno > deno-${{ matrix.arch }}-apple-darwin.sha256sum",
             "zip -r deno-${{ matrix.arch }}-apple-darwin.zip deno",
             "strip denort",
+            "shasum -a 256 denort > denort-${{ matrix.arch }}-apple-darwin.sha256sum",
             "zip -r denort-${{ matrix.arch }}-apple-darwin.zip denort",
           ]
             .join("\n"),
@@ -799,7 +803,9 @@ const ci = {
           ].join("\n"),
           shell: "pwsh",
           run: [
+            "Get-FileHash target/release/deno.exe -Algorithm SHA256 | Format-List > target/release/deno-${{ matrix.arch }}-pc-windows-msvc.sha256sum",
             "Compress-Archive -CompressionLevel Optimal -Force -Path target/release/deno.exe -DestinationPath target/release/deno-${{ matrix.arch }}-pc-windows-msvc.zip",
+            "Get-FileHash target/release/denort.exe -Algorithm SHA256 | Format-List > target/release/denort-${{ matrix.arch }}-pc-windows-msvc.sha256sum",
             "Compress-Archive -CompressionLevel Optimal -Force -Path target/release/denort.exe -DestinationPath target/release/denort-${{ matrix.arch }}-pc-windows-msvc.zip",
           ].join("\n"),
         },
@@ -813,6 +819,7 @@ const ci = {
           ].join("\n"),
           run: [
             'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
+            'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/canary/$(git rev-parse HEAD)/',
             "echo ${{ github.sha }} > canary-latest.txt",
             'gsutil -h "Cache-Control: no-cache" cp canary-latest.txt gs://dl.deno.land/canary-$(rustc -vV | sed -n "s|host: ||p")-latest.txt',
           ].join("\n"),
@@ -994,8 +1001,10 @@ const ci = {
             "github.repository == 'denoland/deno' &&",
             "startsWith(github.ref, 'refs/tags/')",
           ].join("\n"),
-          run:
+          run: [
             'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+            'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+          ].join("\n"),
         },
         {
           name: "Upload release to dl.deno.land (windows)",
@@ -1009,8 +1018,10 @@ const ci = {
           env: {
             CLOUDSDK_PYTHON: "${{env.pythonLocation}}\\python.exe",
           },
-          run:
+          run: [
             'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+            'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/',
+          ].join("\n"),
         },
         {
           name: "Create release notes",
@@ -1040,15 +1051,25 @@ const ci = {
           with: {
             files: [
               "target/release/deno-x86_64-pc-windows-msvc.zip",
+              "target/release/deno-x86_64-pc-windows-msvc.sha256sum",
               "target/release/denort-x86_64-pc-windows-msvc.zip",
+              "target/release/denort-x86_64-pc-windows-msvc.sha256sum",
               "target/release/deno-x86_64-unknown-linux-gnu.zip",
+              "target/release/deno-x86_64-unknown-linux-gnu.sha256sum",
               "target/release/denort-x86_64-unknown-linux-gnu.zip",
+              "target/release/denort-x86_64-unknown-linux-gnu.sha256sum",
               "target/release/deno-x86_64-apple-darwin.zip",
+              "target/release/deno-x86_64-apple-darwin.sha256sum",
               "target/release/denort-x86_64-apple-darwin.zip",
+              "target/release/denort-x86_64-apple-darwin.sha256sum",
               "target/release/deno-aarch64-unknown-linux-gnu.zip",
+              "target/release/deno-aarch64-unknown-linux-gnu.sha256sum",
               "target/release/denort-aarch64-unknown-linux-gnu.zip",
+              "target/release/denort-aarch64-unknown-linux-gnu.sha256sum",
               "target/release/deno-aarch64-apple-darwin.zip",
+              "target/release/deno-aarch64-apple-darwin.sha256sum",
               "target/release/denort-aarch64-apple-darwin.zip",
+              "target/release/denort-aarch64-apple-darwin.sha256sum",
               "target/release/deno_src.tar.gz",
               "target/release/lib.deno.d.ts",
             ].join("\n"),
@@ -1067,6 +1088,7 @@ const ci = {
               "./target",
               "!./target/*/gn_out",
               "!./target/*/*.zip",
+              "!./target/*/*.sha256sum",
               "!./target/*/*.tar.gz",
             ].join("\n"),
             key: prCacheKeyPrefix + "${{ github.sha }}",
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 280eb7cb84c06e..df805cb2350088 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -448,8 +448,10 @@ jobs:
           github.repository == 'denoland/deno')
         run: |-
           cd target/release
+          shasum -a 256 deno > deno-${{ matrix.arch }}-unknown-linux-gnu.sha256sum
           zip -r deno-${{ matrix.arch }}-unknown-linux-gnu.zip deno
           strip denort
+          shasum -a 256 denort > denort-${{ matrix.arch }}-unknown-linux-gnu.sha256sum
           zip -r denort-${{ matrix.arch }}-unknown-linux-gnu.zip denort
           ./deno types > lib.deno.d.ts
       - name: Pre-release (mac)
@@ -465,8 +467,10 @@ jobs:
           echo "Key is $(echo $APPLE_CODESIGN_KEY | base64 -d | wc -c) bytes"
           rcodesign sign target/release/deno --code-signature-flags=runtime --p12-password="$APPLE_CODESIGN_PASSWORD" --p12-file=<(echo $APPLE_CODESIGN_KEY | base64 -d) --entitlements-xml-file=cli/entitlements.plist
           cd target/release
+          shasum -a 256 deno > deno-${{ matrix.arch }}-apple-darwin.sha256sum
           zip -r deno-${{ matrix.arch }}-apple-darwin.zip deno
           strip denort
+          shasum -a 256 denort > denort-${{ matrix.arch }}-apple-darwin.sha256sum
           zip -r denort-${{ matrix.arch }}-apple-darwin.zip denort
       - name: Pre-release (windows)
         if: |-
@@ -476,7 +480,9 @@ jobs:
           github.repository == 'denoland/deno')
         shell: pwsh
         run: |-
+          Get-FileHash target/release/deno.exe -Algorithm SHA256 | Format-List > target/release/deno-${{ matrix.arch }}-pc-windows-msvc.sha256sum
           Compress-Archive -CompressionLevel Optimal -Force -Path target/release/deno.exe -DestinationPath target/release/deno-${{ matrix.arch }}-pc-windows-msvc.zip
+          Get-FileHash target/release/denort.exe -Algorithm SHA256 | Format-List > target/release/denort-${{ matrix.arch }}-pc-windows-msvc.sha256sum
           Compress-Archive -CompressionLevel Optimal -Force -Path target/release/denort.exe -DestinationPath target/release/denort-${{ matrix.arch }}-pc-windows-msvc.zip
       - name: Upload canary to dl.deno.land
         if: |-
@@ -486,6 +492,7 @@ jobs:
           github.ref == 'refs/heads/main')
         run: |-
           gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/canary/$(git rev-parse HEAD)/
+          gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/canary/$(git rev-parse HEAD)/
           echo ${{ github.sha }} > canary-latest.txt
           gsutil -h "Cache-Control: no-cache" cp canary-latest.txt gs://dl.deno.land/canary-$(rustc -vV | sed -n "s|host: ||p")-latest.txt
       - name: Autobahn testsuite
@@ -615,7 +622,9 @@ jobs:
           matrix.profile == 'release' &&
           github.repository == 'denoland/deno' &&
           startsWith(github.ref, 'refs/tags/'))
-        run: 'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/'
+        run: |-
+          gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/
+          gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/
       - name: Upload release to dl.deno.land (windows)
         if: |-
           !(matrix.skip) && (matrix.os == 'windows' &&
@@ -625,7 +634,9 @@ jobs:
           startsWith(github.ref, 'refs/tags/'))
         env:
           CLOUDSDK_PYTHON: '${{env.pythonLocation}}\python.exe'
-        run: 'gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/'
+        run: |-
+          gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.zip gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/
+          gsutil -h "Cache-Control: public, max-age=3600" cp ./target/release/*.sha256sum gs://dl.deno.land/release/${GITHUB_REF#refs/*/}/
       - name: Create release notes
         if: |-
           !(matrix.skip) && (matrix.job == 'test' &&
@@ -647,15 +658,25 @@ jobs:
         with:
           files: |-
             target/release/deno-x86_64-pc-windows-msvc.zip
+            target/release/deno-x86_64-pc-windows-msvc.sha256sum
             target/release/denort-x86_64-pc-windows-msvc.zip
+            target/release/denort-x86_64-pc-windows-msvc.sha256sum
             target/release/deno-x86_64-unknown-linux-gnu.zip
+            target/release/deno-x86_64-unknown-linux-gnu.sha256sum
             target/release/denort-x86_64-unknown-linux-gnu.zip
+            target/release/denort-x86_64-unknown-linux-gnu.sha256sum
             target/release/deno-x86_64-apple-darwin.zip
+            target/release/deno-x86_64-apple-darwin.sha256sum
             target/release/denort-x86_64-apple-darwin.zip
+            target/release/denort-x86_64-apple-darwin.sha256sum
             target/release/deno-aarch64-unknown-linux-gnu.zip
+            target/release/deno-aarch64-unknown-linux-gnu.sha256sum
             target/release/denort-aarch64-unknown-linux-gnu.zip
+            target/release/denort-aarch64-unknown-linux-gnu.sha256sum
             target/release/deno-aarch64-apple-darwin.zip
+            target/release/deno-aarch64-apple-darwin.sha256sum
             target/release/denort-aarch64-apple-darwin.zip
+            target/release/denort-aarch64-apple-darwin.sha256sum
             target/release/deno_src.tar.gz
             target/release/lib.deno.d.ts
           body_path: target/release/release-notes.md
@@ -668,6 +689,7 @@ jobs:
             ./target
             !./target/*/gn_out
             !./target/*/*.zip
+            !./target/*/*.sha256sum
             !./target/*/*.tar.gz
           key: '15-cargo-target-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.profile }}-${{ matrix.job }}-${{ github.sha }}'
   publish-canary: