diff --git a/Makefile b/Makefile
index ef6bf916533e8ed378ff1163b336a71ccc1d6cf2..3e66175d17849f34e3e9b300be7f81e0ae6930e5 100644
--- a/Makefile
+++ b/Makefile
@@ -393,6 +393,14 @@ package_snap:
 package_deb:
 	@make -C build/${PROVIDER} pkg_deb
 
+sign_artifact:
+	@find ${FILE} -type f -not -name "*.asc" -print0 | xargs -0 -n1 -I{} sha256sum -b "{}" | sed 's/*deploy\///' > ${FILE}.sha256
+	@gpg --clear-sign --armor ${FILE}.sha256
+
+upload_artifact:
+	scp ${FILE} downloads.leap.se:./
+	scp ${FILE}.sha256.asc downloads.leap.se:./
+
 
 #########################################################################
 # icons & locales
diff --git a/docs/build-win.rst b/docs/build-win.rst
index 1e65c27bbadbfb5235bc39bb18b1b482d8c261d3..0deff8d0808275af8cf80f230fba611cf13da37c 100644
--- a/docs/build-win.rst
+++ b/docs/build-win.rst
@@ -51,6 +51,15 @@ or all together as::
 
   make package_win_release
 
+Uploading installer
+-------------------
+
+Since 0.21.2, we're hashing and signing the installers::
+
+  export FILE=deploy/RiseupVPN-installer-0.21.2.exe
+  make sign_artifact
+  make upload_artifact
+
 
 unreviewed notes
 ----------------