diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 520e9bc4..27050686 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,6 +13,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write   # release builds open a PR adding the binaries to binaries/
 
 env:
   ARDUINO_BOARD_MANAGER_ADDITIONAL_URLS: "http://arduino.esp8266.com/stable/package_esp8266com_index.json https://espressif.github.io/arduino-esp32/package_esp32_dev_index.json"
@@ -68,6 +69,7 @@ jobs:
           cd HeishaMon
           MD5=`md5sum HeishaMon.ino.bin | cut -d\  -f1`
           mv HeishaMon.ino.bin HeishaMon_ESP8266-${{ env.BUILD_TYPE }}-$MD5.bin
+          echo "MD5_ESP8266=$MD5" >> $GITHUB_ENV
         shell: bash
 
       - name: Compile Sketch for ESP32
@@ -78,6 +80,7 @@ jobs:
           cd HeishaMon
           MD5=`md5sum HeishaMon.ino.bin | cut -d\  -f1`
           mv HeishaMon.ino.bin HeishaMon_ESP32-${{ env.BUILD_TYPE }}-$MD5.bin
+          echo "MD5_ESP32=$MD5" >> $GITHUB_ENV
         shell: bash
 
       - name: Upload artifacts
@@ -120,3 +123,29 @@ jobs:
             Commit: ${{ github.sha }}
           prerelease: true
           files: HeishaMon/HeishaMon_*.bin
+
+      - name: Open PR adding release binaries to binaries/
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          BRANCH="release-binaries-$TAG"
+          # Work on a clean checkout of main, the tag checkout has a modified version.h
+          git fetch --depth=1 origin +refs/heads/main:refs/remotes/origin/main
+          git worktree add -b "$BRANCH" ../release-binaries origin/main
+          cp "HeishaMon/HeishaMon_ESP32-Release-$MD5_ESP32.bin" "../release-binaries/binaries/model-type-large/HeishaMon.ino.esp32-$TAG.bin"
+          echo -n "$MD5_ESP32" > "../release-binaries/binaries/model-type-large/HeishaMon.ino.esp32-$TAG.md5"
+          cp "HeishaMon/HeishaMon_ESP8266-Release-$MD5_ESP8266.bin" "../release-binaries/binaries/model-type-small/HeishaMon.ino.d1-$TAG.bin"
+          echo -n "$MD5_ESP8266" > "../release-binaries/binaries/model-type-small/HeishaMon.ino.d1-$TAG.md5"
+          cd ../release-binaries
+          sed -i "s/^The latest production release is .*\./The latest production release is $TAG./" binaries/README.md
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add binaries/
+          git commit -m "release $TAG binaries"
+          git push origin "$BRANCH"
+          gh pr create --base main --head "$BRANCH" \
+            --title "Release $TAG binaries" \
+            --body "Adds the $TAG firmware built by release run ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} to binaries/ and updates binaries/README.md."
+        shell: bash