diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f22b2390..abce996e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,17 +17,31 @@ jobs:
       - name: Build
         env:
           CGO_ENABLED: '0'
-          GOOS: linux
         run: |
-          for arch in amd64 arm64; do
-            GOARCH=$arch go build \
-              -ldflags "-s -w -X main.version=${GITHUB_REF_NAME}" -o stoat ./cmd/stoat
-            tar czf stoat_${GITHUB_REF_NAME}_linux_$arch.tar.gz stoat
+          # darwin and windows binaries run doctor and capabilities only.
+          # hostops refuses every other command there until #82 and #83 land.
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
+            os=${target%/*}
+            arch=${target#*/}
+            bin=stoat
+            if [ "$os" = windows ]; then
+              bin=stoat.exe
+            fi
+            GOOS=$os GOARCH=$arch go build \
+              -ldflags "-s -w -X main.version=${GITHUB_REF_NAME}" -o "$bin" ./cmd/stoat
+            name=stoat_${GITHUB_REF_NAME}_${os}_${arch}
+            if [ "$os" = windows ]; then
+              zip -q "$name.zip" "$bin"
+            else
+              tar czf "$name.tar.gz" "$bin"
+            fi
+            rm -f "$bin"
           done
-          sha256sum stoat_*.tar.gz > checksums.txt
+          sha256sum stoat_*.tar.gz stoat_*.zip > checksums.txt
       - uses: softprops/action-gh-release@v3
         with:
           generate_release_notes: true
           files: |
             *.tar.gz
+            *.zip
             checksums.txt
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9acba24..96402be5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## Unreleased
+
+### Changes
+
+- Release archives cover darwin (amd64, arm64) and windows (amd64, arm64)
+  next to the linux tarballs. Windows ships a zip. Those binaries run `doctor`
+  and `capabilities` only until #82 and #83 qualify the hosts.
+
 ## v0.4.1
 
 Plainer CLI output and a shorter `stoat.toml` sample, plus the fixes that
diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md
index b7b8600f..d61ccc1c 100644
--- a/docs/getting-started/installation.md
+++ b/docs/getting-started/installation.md
@@ -186,6 +186,14 @@ tar xzf stoat_vX.Y.Z_linux_amd64.tar.gz
 install -Dm755 stoat ~/.local/bin/stoat
 ```
 
+A release also carries `darwin_amd64` and `darwin_arm64` tarballs, and
+`windows_amd64` and `windows_arm64` zip archives. On those hosts Stoat runs
+`doctor` and `capabilities` only. Every other command reports the host as
+unqualified, because macOS needs the QEMU HVF accelerator
+([#82](https://github.com/NovusEdge/stoat/issues/82)) and Windows needs WHPX
+([#83](https://github.com/NovusEdge/stoat/issues/83)). Linux with KVM is the
+supported host today.
+
 ## Install via the Nix flake
 
 The repository includes a `flake.nix` with a default package and development