diff --git a/.github/actions/download-tar/action.yml b/.github/actions/download-tar/action.yml
new file mode 100644
index 00000000..b0e08324
--- /dev/null
+++ b/.github/actions/download-tar/action.yml
@@ -0,0 +1,25 @@
+# This custom action exists because of this issue:
+# https://github.com/actions/upload-artifact/issues/38
+name: Download Tar Artifact
+description: >
+  Download and extract a tar artifact that was previously uploaded in the workflow by the upload-tar
+  action
+
+inputs:
+  name:
+    description: Artifact name
+  path:
+    description: Destination path
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}
+
+    - run: ${{ github.action_path }}/untar.sh "${{ inputs.name }}"
+      working-directory: ${{ inputs.path }}
+      shell: bash
diff --git a/.github/actions/download-tar/untar.sh b/.github/actions/download-tar/untar.sh
new file mode 100755
index 00000000..5dc0136c
--- /dev/null
+++ b/.github/actions/download-tar/untar.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -x
+name="$1"
+
+if [[ "$name" == '' ]]; then
+  dirs=(*/)
+else
+  dirs=(.)
+fi
+
+for dir in ${dirs[@]}; do
+  echo "> Extracting: $dir"
+  pushd "$dir" > /dev/null
+  tar xvf artifact.tar
+  rm artifact.tar
+  popd > /dev/null
+done
diff --git a/.github/actions/upload-tar/action.yml b/.github/actions/upload-tar/action.yml
new file mode 100644
index 00000000..1c4c43d7
--- /dev/null
+++ b/.github/actions/upload-tar/action.yml
@@ -0,0 +1,28 @@
+# This custom action exists because of this issue:
+# https://github.com/actions/upload-artifact/issues/38
+name: Upload Tar Artifact
+description: Compress files with tar prior to artifacting to keep file privileges.
+
+inputs:
+  name:
+    description: Artifact name
+  path:
+    description: A directory path. The contents of that directory will be tarballed and uploaded.
+    required: true
+
+runs:
+  using: composite
+  steps:
+
+    - run: tar cvf artifact.tar *
+      shell: bash
+      working-directory: ${{ inputs.path }}
+
+    - uses: actions/upload-artifact@v3
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}/artifact.tar
+
+    - run: rm artifact.tar
+      shell: bash
+      working-directory: ${{ inputs.path }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8587c8db..56c2af5d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,6 +21,7 @@ on:
       - "ci/**"
 
 jobs:
+  #############################################
   build-win:
     name: Build Windows
     secrets: inherit
@@ -32,6 +33,7 @@ jobs:
       platform: windows-latest
       runtime: ${{ matrix.runtime }}
 
+  #############################################
   build-linux:
     name: Build Linux
     secrets: inherit
@@ -43,6 +45,7 @@ jobs:
       platform: ubuntu-latest
       runtime: ${{ matrix.runtime }}
 
+  #############################################
   build-osx:
     name: Build Mac OS
     secrets: inherit
@@ -57,6 +60,7 @@ jobs:
       # https://github.com/dotnet/runtime/issues/79267
       publish-args: -NoCompress
 
+  #############################################
   build-musl:
     name: Build MUSL
     secrets: inherit
@@ -70,6 +74,7 @@ jobs:
       publish-args: -NoSingleFile
       skip-test: true
 
+  #############################################
   codesign:
     name: Apple Signing
     runs-on: macos-latest
@@ -85,7 +90,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v3
+        uses: ./.github/actions/download-tar
         with:
           name: ${{ matrix.runtime }}
           path: publish
@@ -120,17 +125,19 @@ jobs:
       #   run: xcrun stapler staple -v publish/recyclarr
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
+        uses: ./.github/actions/upload-tar
         with:
           name: ${{ matrix.runtime }}
-          path: publish/*
+          path: publish
 
+  #############################################
   docker:
     name: Docker
     needs: [build-musl]
     uses: ./.github/workflows/reusable-docker.yml
     secrets: inherit
 
+  #############################################
   release:
     name: Release
     runs-on: ubuntu-latest
@@ -158,7 +165,7 @@ jobs:
         id: gitversion
 
       - name: Download Artifacts
-        uses: actions/download-artifact@v3
+        uses: ./.github/actions/download-tar
         with:
           path: publish
 
@@ -178,12 +185,15 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.DEPLOY_PAT }}
         with:
-          files: archive/*
+          files: |
+            archive/**/recyclarr-*.zip
+            archive/**/recyclarr-*.tar.xz
           body: ${{ steps.changelog.outputs.release_notes }}
           tag_name: ${{ github.event.create.ref }}
           draft: false
           prerelease: ${{ steps.gitversion.outputs.preReleaseTag != '' }}
 
+  #############################################
   # The main purpose of this job is to group all the other jobs together into one single job status
   # that can be set as a requirement to merge pull requests. This is easier than enumerating all
   # jobs in a workflow to ensure they all pass.
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index d36655ce..a34e3a15 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -39,16 +39,15 @@ jobs:
 
       - name: Publish
         shell: pwsh
-        run: |
-          ci/Publish.ps1 -Runtime ${{ inputs.runtime }} ${{ inputs.publish-args }}
+        run: ci/Publish.ps1 -Runtime ${{ inputs.runtime }} ${{ inputs.publish-args }}
 
       - name: Smoke
         if: endsWith(inputs.runtime, 'x64') && !inputs.skip-test
         shell: pwsh
         run: ci/SmokeTest.ps1 publish/${{ inputs.runtime }}/recyclarr
 
-      - name: Upload Artifacts
-        uses: actions/upload-artifact@v3
+      - name: Upload Artifact
+        uses: ./.github/actions/upload-tar
         with:
           name: ${{ inputs.runtime }}
-          path: publish/${{ inputs.runtime }}/*
+          path: publish/${{ inputs.runtime }}
diff --git a/.github/workflows/reusable-docker.yml b/.github/workflows/reusable-docker.yml
index 1301bbb1..c2d009fc 100644
--- a/.github/workflows/reusable-docker.yml
+++ b/.github/workflows/reusable-docker.yml
@@ -45,7 +45,7 @@ jobs:
             ${{ env.SEMVER }},pattern={{major}}
 
       - name: Grab Artifacts
-        uses: actions/download-artifact@v3
+        uses: ./.github/actions/download-tar
         with:
           path: docker/artifacts
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f973c74..cc3adecc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Releases now retain executable permissions on Linux and macOS.
+
 ## [4.0.1] - 2022-12-21
 
 ### Changed
diff --git a/docker/BuildAndRun.ps1 b/docker/BuildAndRun.ps1
index 3b406c5c..05ef2768 100644
--- a/docker/BuildAndRun.ps1
+++ b/docker/BuildAndRun.ps1
@@ -1,7 +1,7 @@
 [CmdletBinding()]
 param (
-    [string[]] $RunArgs,
-    [string] $Runtime = "linux-musl-x64"
+    [string] $Runtime = "linux-musl-x64",
+    [string[]] $RunArgs
 )
 
 $ErrorActionPreference = "Stop"
diff --git a/docker/Dockerfile b/docker/Dockerfile
index bea1739e..3cb6fd87 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,17 +1,15 @@
-FROM mcr.microsoft.com/dotnet/sdk:7.0-alpine AS build
+FROM mcr.microsoft.com/dotnet/runtime:7.0-alpine as base
 
-WORKDIR /build
+FROM base AS base-arm
+ENV RUNTIME=linux-musl-arm
 
-ARG TARGETPLATFORM
+FROM base AS base-arm64
+ENV RUNTIME=linux-musl-arm64
 
-RUN apk add unzip bash
+FROM base AS base-amd64
+ENV RUNTIME=linux-musl-x64
 
-COPY --chmod=544 ./scripts/build/*.sh .
-COPY ./artifacts ./artifacts
-RUN ./build.sh
-
-#############################################################################
-FROM mcr.microsoft.com/dotnet/runtime:7.0-alpine AS final
+FROM base-$TARGETARCH AS final
 
 # Required by environment and/or dotnet
 ENV PATH="${PATH}:/app/recyclarr" \
@@ -23,7 +21,7 @@ RUN set -ex; \
     apk add --no-cache bash tzdata supercronic git tini; \
     mkdir -p /config && chown 1000:1000 /config;
 
-COPY --from=build /build/publish /app/recyclarr/
+COPY ./artifacts/$RUNTIME /app/recyclarr/
 COPY --chmod=555 ./scripts/prod/*.sh /
 
 USER 1000:1000
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index e364ae37..f0781aa2 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -10,7 +10,7 @@ services:
     build:
       context: .
       args:
-        - TARGETPLATFORM=linux/amd64
+        - TARGETARCH=amd64
     networks: [recyclarr]
     volumes:
       - ./config:/config
diff --git a/docker/scripts/build/build.sh b/docker/scripts/build/build.sh
deleted file mode 100644
index 11a11a39..00000000
--- a/docker/scripts/build/build.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-set -ex
-
-# Determine the runtime from the target platform provided by Docker Buildx
-case "$TARGETPLATFORM" in
-    "linux/arm/v7") runtime="linux-musl-arm" ;;
-    "linux/arm64") runtime="linux-musl-arm64" ;;
-    "linux/amd64") runtime="linux-musl-x64" ;;
-    *) echo >&2 "ERROR: Unsupported target platform: $TARGETPLATFORM"; exit 1 ;;
-esac
-
-path="artifacts/$runtime/"
-
-mv "$path" publish
-
-chmod a+rx publish/recyclarr