diff --git a/.dockerignore b/.dockerignore
index 7916dff..754bfcf 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,6 @@
 .git/
 data/
+dist/
 ufile
 frontend/node_modules/
 frontend/dist/
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 30387ef..7f5d852 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -12,11 +12,24 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build CLI binaries
-        run: ./scripts/build-cli.sh
+      - name: Build CLI artifact image
+        run: |
+          docker build \
+            --target cli-artifacts \
+            --build-arg GOPROXY=https://goproxy.cn,direct \
+            --build-arg VERSION=${{ github.sha }} \
+            --build-arg COMMIT=${{ github.sha }} \
+            -t ufile-cli-artifacts:latest .
 
-      - name: Verify CLI checksums
-        run: cd dist && sha256sum -c checksums.txt
+      - name: Extract CLI binaries
+        run: |
+          container="ufile-cli-artifacts-$$"
+          docker run -d --name "$container" ufile-cli-artifacts:latest
+          trap 'docker rm -f "$container" >/dev/null 2>&1 || true' EXIT
+          mkdir -p dist
+          docker cp "$container:/dist/." dist/
+          cd dist
+          sha256sum -c checksums.txt
 
       - name: Build image
         run: docker build --build-arg GOPROXY=https://goproxy.cn,direct -t ufile:latest .
diff --git a/Dockerfile b/Dockerfile
index 6043e06..3b0d8aa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,6 +18,25 @@ COPY *.go ./
 COPY --from=frontend /src/frontend/dist ./frontend/dist
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /ufile .
 
+FROM golang:1.24-alpine AS cli-builder
+
+ARG GOPROXY=https://proxy.golang.org,direct
+ARG VERSION=dev
+ARG COMMIT=unknown
+ENV GOPROXY=${GOPROXY}
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY cmd/ufile-cli/ ./cmd/ufile-cli/
+COPY scripts/build-cli.sh ./scripts/build-cli.sh
+RUN VERSION="${VERSION}" COMMIT="${COMMIT}" ./scripts/build-cli.sh
+
+FROM alpine:3.22 AS cli-artifacts
+
+COPY --from=cli-builder /src/dist /dist
+CMD ["sh", "-c", "while :; do sleep 3600; done"]
+
 FROM alpine:3.22
 
 RUN addgroup -S -g 10001 ufile \