diff --git a/.github/workflows/release-deterministic.yml b/.github/workflows/release-deterministic.yml
new file mode 100644
index 000000000000..694845f59e13
--- /dev/null
+++ b/.github/workflows/release-deterministic.yml
@@ -0,0 +1,84 @@
+name: Release Deterministic Binding
+
+on:
+  push:
+    tags:
+      - 'v*-deterministic'
+
+permissions:
+  contents: write
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build binding in Docker
+        run: |
+          docker run --rm \
+            -e CARGO_INCREMENTAL=0 \
+            -e CI=1 \
+            -v ${{ github.workspace }}:/rspack \
+            -w /rspack \
+            ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian \
+            bash -c '
+              set -ex
+              rustup target add x86_64-unknown-linux-gnu
+              npm install -g corepack@0.31.0 --force
+              corepack enable
+              mkdir -p .cargo
+              touch .cargo/config.toml
+              echo "" >> .cargo/config.toml
+              echo "trim-paths = true" >> .cargo/config.toml
+              pnpm install --frozen-lockfile
+              cargo codegen
+              RUST_TARGET=x86_64-unknown-linux-gnu pnpm build:binding:release
+            '
+          sudo chown -R $USER:$USER .
+
+      - name: Verify glibc compatibility
+        run: |
+          objdump -T crates/node_binding/rspack.linux-x64-gnu.node \
+            | grep GLIBC_ | sed 's/.*GLIBC_/GLIBC_/' | sort -uV | tail -5
+          MAX_GLIBC=$(objdump -T crates/node_binding/rspack.linux-x64-gnu.node \
+            | grep -oP 'GLIBC_\d+\.\d+' | sort -t. -k1,1n -k2,2n | tail -1)
+          echo "Max GLIBC requirement: $MAX_GLIBC"
+          if [[ "$MAX_GLIBC" > "GLIBC_2.17" ]]; then
+            echo "ERROR: Max GLIBC $MAX_GLIBC exceeds 2.17 — binary may not work on RBE workers"
+            exit 1
+          fi
+
+      - name: Package tarball
+        run: |
+          VERSION="${{ github.ref_name }}"
+          VERSION="${VERSION#v}"  # strip leading 'v'
+          mkdir -p package
+          cp crates/node_binding/rspack.linux-x64-gnu.node package/
+          cat > package/package.json << EOF
+          {
+            "name": "@rspack/binding-linux-x64-gnu",
+            "version": "${VERSION%-deterministic}",
+            "os": ["linux"],
+            "cpu": ["x64"],
+            "main": "rspack.linux-x64-gnu.node",
+            "files": ["rspack.linux-x64-gnu.node"],
+            "license": "MIT",
+            "description": "Patched rspack binding with deterministic contenthash fixes"
+          }
+          EOF
+          sed -i 's/^          //' package/package.json
+          cat package/package.json
+          tar czf rspack-binding-linux-x64-gnu-deterministic.tgz package/
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: rspack-binding-linux-x64-gnu-deterministic.tgz
+          body: |
+            Patched `@rspack/binding-linux-x64-gnu` with deterministic contenthash fixes for RBE builds.
+
+            Built with upstream's Docker image (`ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian`) and `release` profile (fat LTO, strip, codegen-units=1).
+
+            See the `v1.7.5-deterministic` branch for the source diff against upstream v1.7.5.
diff --git a/Cargo.lock b/Cargo.lock
index f8e6589d3825..de6cbf1092f4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3243,9 +3243,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha",