diff --git a/.github/workflows/generate-keystore.yml b/.github/workflows/generate-keystore.yml
new file mode 100644
index 0000000..7c71ef3
--- /dev/null
+++ b/.github/workflows/generate-keystore.yml
@@ -0,0 +1,35 @@
+name: Generate Keystore (run once)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  generate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+
+      - name: Generate keystore
+        run: |
+          keytool -genkeypair \
+            -keystore helios-release.jks \
+            -alias helios \
+            -keyalg RSA \
+            -keysize 2048 \
+            -validity 10000 \
+            -storepass helios123 \
+            -keypass helios123 \
+            -dname "CN=Helios, OU=Helios, O=Helios, L=Berlin, ST=Berlin, C=DE"
+          echo "KEYSTORE_B64=$(base64 -w 0 helios-release.jks)" >> $GITHUB_OUTPUT
+        id: keygen
+
+      - name: Upload keystore
+        uses: actions/upload-artifact@v4
+        with:
+          name: helios-release-keystore
+          path: helios-release.jks
+          retention-days: 1