diff --git a/.github/workflows/release-tiup.yaml b/.github/workflows/release-tiup.yaml
index 0aa03c2359..d8b14da49c 100644
--- a/.github/workflows/release-tiup.yaml
+++ b/.github/workflows/release-tiup.yaml
@@ -54,8 +54,9 @@ jobs:
           STAGING_VER=`git describe --tags | sed -r "s/([^-]*-g)/r\1/"`
           echo ::set-output name=STAGING::$STAGING_VER
 
-      - name: Get git ref
-        id: get_ref
+      - name: Get git ref and commit
+        id: get_git
+        working-directory: ${{ env.working-directory }}
         # when empty, it will be determined by Makefile
         run: |
           if [[ $GITHUB_REF == refs/tags/* ]]; then
@@ -63,6 +64,8 @@ jobs:
           elif [[ $GITHUB_REF == refs/heads/* ]]; then
             echo ::set-output name=GIT_REF::${GITHUB_REF/refs\/heads\//}
           fi
+          COMMIT_TIMESTAMP=`git show --no-patch --no-notes --pretty='%aI'`
+          echo ::set-output name=COMMIT_TIMESTAMP::$COMMIT_TIMESTAMP
 
       - name: Build for ${{ matrix.os }}-${{ matrix.arch }}
         id: build_tiup
@@ -71,7 +74,7 @@ jobs:
           GOOS: ${{ matrix.os }}
           GOARCH: ${{ matrix.arch }}
           COMMIT: ${GITHUB_SHA}
-          GITREF: ${{ steps.get_ref.outputs.GIT_REF }}
+          GITREF: ${{ steps.get_git.outputs.GIT_REF }}
           actor: ${{ github.actor }}
           event: ${{ github.event_name }}
         run: |
@@ -89,7 +92,7 @@ jobs:
           BUILD_FLAGS='-trimpath -buildmode=pie' make build ctl && echo "Build success."
 
           checksum_file=checksum.${{ matrix.os }}-${{ matrix.arch }}.txt
-          checksum_header="TiUP $REL_VER (${actor}@${event}) ${{ github.run_id }} `date +%s`"
+          checksum_header="TiUP $REL_VER (${actor}@${event}) ${{ github.run_id }}"
           echo ${checksum_header} > ${checksum_file}
           echo "sha256sum:" >> ${checksum_file}
           sha256sum bin/* >> ${checksum_file}
@@ -118,18 +121,21 @@ jobs:
           mkdir -p package
           cp $TIUP_HOME/bin/root.json bin/root.json
 
+          # make tar reproducible
+          TAR="tar --sort=name --mtime=${{ steps.get_git.outputs.COMMIT_TIMESTAMP }} --owner=0 --group=0 --numeric-owner"
+
           # package all binaries to upload to github release asset
-          tar -czf tiup-${REL_VER}-${ARCH}.tar.gz bin checksum.${{ matrix.os }}-${{ matrix.arch }}.txt
+          ${TAR} -czf tiup-${REL_VER}-${ARCH}.tar.gz bin checksum.${{ matrix.os }}-${{ matrix.arch }}.txt
 
           # package each component
           # tiup-ctl is destributed with other components, so not packaging / publishing here
-          tar -C bin -czf package/tiup-${REL_VER}-${ARCH}.tar.gz tiup
-          tar -C bin -czf package/cluster-${REL_VER}-${ARCH}.tar.gz tiup-cluster
-          tar -C bin -czf package/dm-${REL_VER}-${ARCH}.tar.gz tiup-dm
-          tar -C bin -czf package/playground-${REL_VER}-${ARCH}.tar.gz tiup-playground
-          tar -C bin -czf package/client-${REL_VER}-${ARCH}.tar.gz tiup-client
-          tar -C bin -czf package/bench-${REL_VER}-${ARCH}.tar.gz tiup-bench
-          tar -C bin -czf package/server-${REL_VER}-${ARCH}.tar.gz tiup-server
+          ${TAR} -C bin -czf package/tiup-${REL_VER}-${ARCH}.tar.gz tiup
+          ${TAR} -C bin -czf package/cluster-${REL_VER}-${ARCH}.tar.gz tiup-cluster
+          ${TAR} -C bin -czf package/dm-${REL_VER}-${ARCH}.tar.gz tiup-dm
+          ${TAR} -C bin -czf package/playground-${REL_VER}-${ARCH}.tar.gz tiup-playground
+          ${TAR} -C bin -czf package/client-${REL_VER}-${ARCH}.tar.gz tiup-client
+          ${TAR} -C bin -czf package/bench-${REL_VER}-${ARCH}.tar.gz tiup-bench
+          ${TAR} -C bin -czf package/server-${REL_VER}-${ARCH}.tar.gz tiup-server
 
       - name: Publish packages
         working-directory: ${{ env.working-directory }}