diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 11fb5dc..3223cca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,7 @@ on:
   push:
     tags:
       - "*"
+      - "!kbuildx-v*"
 
 jobs:
   publish:
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 826e5ef..00722d6 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -3,6 +3,7 @@ on:
   push:
     tags:
       - "*"
+      - "!kbuildx-v*"
   workflow_dispatch:
     inputs:
       tag:
diff --git a/.github/workflows/e2e-host.yml b/.github/workflows/e2e-host.yml
index 31c3e58..fde161d 100644
--- a/.github/workflows/e2e-host.yml
+++ b/.github/workflows/e2e-host.yml
@@ -2,6 +2,8 @@ name: Host end-to-end tests
 
 on:
   push:
+    tags-ignore:
+      - "kbuildx-v*"
   pull_request:
   workflow_dispatch:
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 5dc55db..1865ec5 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -2,6 +2,8 @@ name: End-to-end tests
 
 on:
   push:
+    tags-ignore:
+      - "kbuildx-v*"
   pull_request:
   workflow_dispatch:
 
diff --git a/.github/workflows/kbuildx-release.yml b/.github/workflows/kbuildx-release.yml
new file mode 100644
index 0000000..33c6676
--- /dev/null
+++ b/.github/workflows/kbuildx-release.yml
@@ -0,0 +1,85 @@
+name: kbuildx release
+
+on:
+  push:
+    tags:
+      - "kbuildx-v*"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build (${{ matrix.target }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+          - runner: macos-latest
+            target: aarch64-apple-darwin
+    runs-on: ${{ matrix.runner }}
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: kbuildx -> target
+          key: ${{ matrix.target }}
+
+      - name: Build release binary
+        run: cargo build --release --locked --target "${{ matrix.target }}"
+        working-directory: ./kbuildx
+
+      - name: Package release binary
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          set -euo pipefail
+          archive="${GITHUB_REF_NAME}-${TARGET}.tar.gz"
+          mkdir -p package
+          cp "kbuildx/target/${TARGET}/release/kbuildx" package/kbuildx
+          tar -C package -czf "$archive" kbuildx
+          shasum -a 256 "$archive" > "$archive.sha256"
+
+      - name: Upload packaged binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: kbuildx-${{ matrix.target }}
+          path: |
+            kbuildx-*.tar.gz
+            kbuildx-*.tar.gz.sha256
+          if-no-files-found: error
+
+  release:
+    name: Publish GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: kbuildx-*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Publish release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: |
+            release-assets/*.tar.gz
+            release-assets/*.tar.gz.sha256
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 2fa2a2f..b3f72c2 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -2,6 +2,8 @@ name: Nix build
 
 on:
   push:
+    tags-ignore:
+      - "kbuildx-v*"
   pull_request:
   workflow_dispatch:
 
@@ -19,7 +21,7 @@ jobs:
             system: x86_64-linux
           - runner: ubuntu-24.04-arm
             system: aarch64-linux
-          - runner: macos-15
+          - runner: macos-latest
             system: aarch64-darwin
     runs-on: ${{ matrix.runner }}
 
diff --git a/kbuildx/src/tui.rs b/kbuildx/src/tui.rs
index 48255f6..1499faf 100644
--- a/kbuildx/src/tui.rs
+++ b/kbuildx/src/tui.rs
@@ -79,6 +79,7 @@ struct App {
     logs: Vec<String>,
     partial_log: String,
     pending_carriage_return: bool,
+    terminal_escape_state: u8,
     log_top: usize,
     follow_logs: bool,
     fullscreen_logs: bool,
@@ -131,6 +132,7 @@ impl App {
             logs: vec!["Loading kernel versions…".to_string()],
             partial_log: String::new(),
             pending_carriage_return: false,
+            terminal_escape_state: 0,
             log_top: 0,
             follow_logs: true,
             fullscreen_logs: false,
@@ -253,6 +255,7 @@ impl App {
         self.logs.clear();
         self.partial_log.clear();
         self.pending_carriage_return = false;
+        self.terminal_escape_state = 0;
         self.logs.push(if self.build_args.is_empty() {
             format!(
                 "Starting Linux {} with {} config override(s), {} vCPU, {} MiB",
@@ -476,7 +479,35 @@ impl App {
     }
 
     fn consume_output(&mut self, chunk: &[u8]) {
-        for character in String::from_utf8_lossy(chunk).chars() {
+        let mut visible = Vec::with_capacity(chunk.len());
+        for &byte in chunk {
+            match self.terminal_escape_state {
+                0 if byte == 0x1b => self.terminal_escape_state = 1,
+                0 => visible.push(byte),
+                1 => {
+                    self.terminal_escape_state = match byte {
+                        b'[' => 2,
+                        b']' => 3,
+                        _ => 0,
+                    };
+                }
+                2 => {
+                    if (0x40..=0x7e).contains(&byte) {
+                        self.terminal_escape_state = 0;
+                    }
+                }
+                3 => match byte {
+                    0x07 => self.terminal_escape_state = 0,
+                    0x1b => self.terminal_escape_state = 4,
+                    _ => {}
+                },
+                4 => {
+                    self.terminal_escape_state = if byte == b'\\' { 0 } else { 3 };
+                }
+                _ => self.terminal_escape_state = 0,
+            }
+        }
+        for character in String::from_utf8_lossy(&visible).chars() {
             if self.pending_carriage_return {
                 self.pending_carriage_return = false;
                 if character == '\n' {
@@ -488,6 +519,11 @@ impl App {
             match character {
                 '\r' => self.pending_carriage_return = true,
                 '\n' => self.finish_partial_log(),
+                '\u{8}' => {
+                    self.partial_log.pop();
+                }
+                '\t' => self.partial_log.push_str("    "),
+                character if character.is_control() => {}
                 _ => self.partial_log.push(character),
             }
         }
@@ -749,7 +785,8 @@ fn draw_fullscreen_logs(frame: &mut Frame, app: &mut App) {
 
 fn draw_logs(frame: &mut Frame, app: &mut App, area: Rect) {
     let height = area.height.saturating_sub(2) as usize;
-    let max_top = app.logs.len().saturating_sub(height);
+    let visible_lines = app.logs.len() + usize::from(!app.partial_log.is_empty());
+    let max_top = visible_lines.saturating_sub(height);
     if app.follow_logs {
         app.log_top = max_top;
     } else {
@@ -1136,6 +1173,19 @@ mod tests {
         assert_eq!(app.partial_log, "next");
     }
 
+    #[test]
+    fn output_chunks_remove_terminal_control_sequences() {
+        let mut app = App::new();
+        app.logs.clear();
+
+        app.consume_output(b"\x1b[38;2;125;");
+        app.consume_output(b"86;244m[1/4 SANDBOX]\x1b[0m Configuring sandbox\n");
+        app.consume_output(b"install 10%\x1b[2K\rinstall 20%");
+
+        assert_eq!(app.logs, ["[1/4 SANDBOX] Configuring sandbox"]);
+        assert_eq!(app.partial_log, "install 20%");
+    }
+
     #[cfg(unix)]
     #[test]
     fn build_output_uses_a_real_terminal() {