diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 6bba61d..500f45f 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -1,4 +1,5 @@
-# Builds and publishes Android packages and binaries
+# File generated by `go run ./GHGEN`; DO NOT EDIT.
+
 name: android
 on:
   push:
@@ -12,12 +13,8 @@ on:
     - cron: "17 1 * * *"
 
 jobs:
-
-  build_and_publish_mobile:
+  build_android_mobile:
     runs-on: ubuntu-20.04
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
-
     steps:
       - uses: actions/checkout@v2
         with:
@@ -26,7 +23,6 @@ jobs:
       - name: Get GOVERSION content
         id: goversion
         run: echo ::set-output name=version::$(cat GOVERSION)
-
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
@@ -41,18 +37,49 @@ jobs:
 
       - run: make MOBILE/android
 
-      - run: |
-          ./script/ghpublish.bash ./MOBILE/android/oonimkall.aar \
-                                  ./MOBILE/android/oonimkall-sources.jar \
-                                  ./MOBILE/android/oonimkall.pom
+      - uses: actions/upload-artifact@v2
+        with:
+          name: oonimkall.aar
+          path: ./MOBILE/android/oonimkall.aar
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: oonimkall-sources.jar
+          path: ./MOBILE/android/oonimkall-sources.jar
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: oonimkall.pom
+          path: ./MOBILE/android/oonimkall.pom
+
+  publish_android_mobile:
+    runs-on: ubuntu-20.04
+    needs: build_android_mobile
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: oonimkall.aar
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: oonimkall-sources.jar
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: oonimkall.pom
+
+      - run: ./script/ghpublish.bash oonimkall.aar oonimkall-sources.jar oonimkall.pom
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  build_and_publish_cli_386:
+  build_android_cli_386:
     runs-on: ubuntu-20.04
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
-
     steps:
       - uses: actions/checkout@v2
         with:
@@ -61,7 +88,6 @@ jobs:
       - name: Get GOVERSION content
         id: goversion
         run: echo ::set-output name=version::$(cat GOVERSION)
-
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
@@ -76,17 +102,40 @@ jobs:
 
       - run: make CLI/android-386
 
-      - run: |
-          ./script/ghpublish.bash ./CLI/miniooni-android-386 \
-                                  ./CLI/ooniprobe-android-386
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-android-386
+          path: ./CLI/miniooni-android-386
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-android-386
+          path: ./CLI/ooniprobe-android-386
+
+  publish_android_cli_386:
+    runs-on: ubuntu-20.04
+    needs: build_android_cli_386
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-android-386
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-android-386
+
+      - run: ./script/ghpublish.bash miniooni-android-386 ooniprobe-android-386
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  build_and_publish_cli_amd64:
+  build_android_cli_amd64:
     runs-on: ubuntu-20.04
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
-
     steps:
       - uses: actions/checkout@v2
         with:
@@ -95,7 +144,6 @@ jobs:
       - name: Get GOVERSION content
         id: goversion
         run: echo ::set-output name=version::$(cat GOVERSION)
-
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
@@ -110,17 +158,40 @@ jobs:
 
       - run: make CLI/android-amd64
 
-      - run: |
-          ./script/ghpublish.bash ./CLI/miniooni-android-amd64 \
-                                  ./CLI/ooniprobe-android-amd64
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-android-amd64
+          path: ./CLI/miniooni-android-amd64
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-android-amd64
+          path: ./CLI/ooniprobe-android-amd64
+
+  publish_android_cli_amd64:
+    runs-on: ubuntu-20.04
+    needs: build_android_cli_amd64
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-android-amd64
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-android-amd64
+
+      - run: ./script/ghpublish.bash miniooni-android-amd64 ooniprobe-android-amd64
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  build_and_publish_cli_arm:
+  build_android_cli_arm:
     runs-on: ubuntu-20.04
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
-
     steps:
       - uses: actions/checkout@v2
         with:
@@ -129,7 +200,6 @@ jobs:
       - name: Get GOVERSION content
         id: goversion
         run: echo ::set-output name=version::$(cat GOVERSION)
-
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
@@ -144,17 +214,40 @@ jobs:
 
       - run: make CLI/android-arm
 
-      - run: |
-          ./script/ghpublish.bash ./CLI/miniooni-android-arm \
-                                  ./CLI/ooniprobe-android-arm
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-android-arm
+          path: ./CLI/miniooni-android-arm
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-android-arm
+          path: ./CLI/ooniprobe-android-arm
+
+  publish_android_cli_arm:
+    runs-on: ubuntu-20.04
+    needs: build_android_cli_arm
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-android-arm
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-android-arm
+
+      - run: ./script/ghpublish.bash miniooni-android-arm ooniprobe-android-arm
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  build_and_publish_cli_arm64:
+  build_android_cli_arm64:
     runs-on: ubuntu-20.04
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
-
     steps:
       - uses: actions/checkout@v2
         with:
@@ -163,7 +256,6 @@ jobs:
       - name: Get GOVERSION content
         id: goversion
         run: echo ::set-output name=version::$(cat GOVERSION)
-
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
@@ -178,8 +270,36 @@ jobs:
 
       - run: make CLI/android-arm64
 
-      - run: |
-          ./script/ghpublish.bash ./CLI/miniooni-android-arm64 \
-                                  ./CLI/ooniprobe-android-arm64
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-android-arm64
+          path: ./CLI/miniooni-android-arm64
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-android-arm64
+          path: ./CLI/ooniprobe-android-arm64
+
+  publish_android_cli_arm64:
+    runs-on: ubuntu-20.04
+    needs: build_android_cli_arm64
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-android-arm64
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-android-arm64
+
+      - run: ./script/ghpublish.bash miniooni-android-arm64 ooniprobe-android-arm64
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+# End of autogenerated file
diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index 1c2218b..5e10646 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -1,21 +1,20 @@
-# Builds for iOS and publishes packages
+# File generated by `go run ./GHGEN`; DO NOT EDIT.
+
 name: ios
 on:
   push:
     branches:
       - "release/**"
       - "fullbuild"
+      - "iosbuild"
     tags:
       - "v*"
   schedule:
     - cron: "17 1 * * *"
 
 jobs:
-  build_and_publish:
-    runs-on: macos-10.15
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
-
+  build_ios_mobile:
+    runs-on: macos-11
     steps:
       - uses: actions/checkout@v2
         with:
@@ -24,7 +23,6 @@ jobs:
       - name: Get GOVERSION content
         id: goversion
         run: echo ::set-output name=version::$(cat GOVERSION)
-
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
@@ -37,10 +35,38 @@ jobs:
           PSIPHON_CONFIG_KEY: ${{ secrets.PSIPHON_CONFIG_KEY }}
           PSIPHON_CONFIG_JSON_AGE_BASE64: ${{ secrets.PSIPHON_CONFIG_JSON_AGE_BASE64 }}
 
-      - run: make EXPECTED_XCODE_VERSION=12.4 MOBILE/ios
+      - run: make EXPECTED_XCODE_VERSION=13.2.1 MOBILE/ios
 
-      - run: |
-          ./script/ghpublish.bash ./MOBILE/ios/oonimkall.xcframework.zip \
-                                  ./MOBILE/ios/oonimkall.podspec
+      - uses: actions/upload-artifact@v2
+        with:
+          name: oonimkall.xcframework.zip
+          path: ./MOBILE/ios/oonimkall.xcframework.zip
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: oonimkall.podspec
+          path: ./MOBILE/ios/oonimkall.podspec
+
+  publish_ios_mobile:
+    runs-on: ubuntu-20.04
+    needs: build_ios_mobile
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: oonimkall.xcframework.zip
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: oonimkall.podspec
+
+      - run: ./script/ghpublish.bash oonimkall.xcframework.zip oonimkall.podspec
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+# End of autogenerated file
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 0d79be9..22bf594 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -1,4 +1,5 @@
-# Builds and publishes ooniprobe and miniooni for Linux
+# File generated by `go run ./GHGEN`; DO NOT EDIT.
+
 name: linux
 on:
   push:
@@ -12,10 +13,8 @@ on:
     - cron: "17 1 * * *"
 
 jobs:
-  build_and_publish_386:
-    runs-on: "ubuntu-20.04"
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
+  build_linux_cli_386:
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
         with:
@@ -35,17 +34,40 @@ jobs:
 
       - run: make CLI/linux-static-386
 
-      - run: ./E2E/ooniprobe.bash ./CLI/ooniprobe-linux-386
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-linux-386
+          path: ./CLI/ooniprobe-linux-386
 
-      - run: ./script/ghpublish.bash ./CLI/ooniprobe-linux-386 ./CLI/miniooni-linux-386
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-linux-386
+          path: ./CLI/miniooni-linux-386
+
+  publish_linux_cli_386:
+    runs-on: ubuntu-20.04
+    needs: build_linux_cli_386
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-linux-386
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-linux-386
+
+      - run: ./script/ghpublish.bash ooniprobe-linux-386 miniooni-linux-386
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-
-  build_and_publish_amd64:
-    runs-on: "ubuntu-20.04"
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
+  build_linux_cli_amd64:
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
         with:
@@ -65,7 +87,31 @@ jobs:
 
       - run: make CLI/linux-static-amd64
 
-      - run: ./E2E/ooniprobe.bash ./CLI/ooniprobe-linux-amd64
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-linux-amd64
+          path: ./CLI/ooniprobe-linux-amd64
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-linux-amd64
+          path: ./CLI/miniooni-linux-amd64
+
+  test_linux_cli_amd64:
+    runs-on: ubuntu-20.04
+    needs: build_linux_cli_amd64
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-linux-amd64
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-linux-amd64
 
       - name: Get GOVERSION content
         id: goversion
@@ -73,26 +119,49 @@ jobs:
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
-          cache-key-suffix: "-windows-${{ steps.goversion.outputs.version }}"
+          cache-key-suffix: "-linux-amd64-${{ steps.goversion.outputs.version }}"
+
       - run: sudo apt-get update -q
       - run: sudo apt-get install -y tor
-      - run: ./E2E/miniooni.bash ./CLI/miniooni-linux-amd64
 
-      - run: ./script/ghpublish.bash ./CLI/ooniprobe-linux-amd64 ./CLI/miniooni-linux-amd64
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: chmod +x ooniprobe-linux-amd64
+      - run: ./E2E/ooniprobe.bash ./ooniprobe-linux-amd64
+        shell: bash
 
-  build_and_publish_armv6:
-    runs-on: "ubuntu-20.04"
-    permissions: # See https://github.com/ooni/probe/issues/2154
+      - run: chmod +x miniooni-linux-amd64
+      - run: ./E2E/miniooni.bash ./miniooni-linux-amd64
+        shell: bash
+
+  publish_linux_cli_amd64:
+    runs-on: ubuntu-20.04
+    needs: test_linux_cli_amd64
+    permissions:
       contents: write
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
 
-      - run: sudo apt-get update -q
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-linux-amd64
 
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-linux-amd64
+
+      - run: ./script/ghpublish.bash ooniprobe-linux-amd64 miniooni-linux-amd64
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build_linux_cli_armv6:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - run: sudo apt-get update -q
       - run: sudo apt-get install -y qemu-user-static
 
       - run: |
@@ -109,23 +178,46 @@ jobs:
 
       - run: make CLI/linux-static-armv6
 
-      - run: ./E2E/ooniprobe.bash ./CLI/ooniprobe-linux-armv6
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-linux-armv6
+          path: ./CLI/ooniprobe-linux-armv6
 
-      - run: ./script/ghpublish.bash ./CLI/ooniprobe-linux-armv6 ./CLI/miniooni-linux-armv6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-linux-armv6
+          path: ./CLI/miniooni-linux-armv6
 
-  build_and_publish_armv7:
-    runs-on: "ubuntu-20.04"
-    permissions: # See https://github.com/ooni/probe/issues/2154
+  publish_linux_cli_armv6:
+    runs-on: ubuntu-20.04
+    needs: build_linux_cli_armv6
+    permissions:
       contents: write
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
 
-      - run: sudo apt-get update -q
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-linux-armv6
 
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-linux-armv6
+
+      - run: ./script/ghpublish.bash ooniprobe-linux-armv6 miniooni-linux-armv6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build_linux_cli_armv7:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - run: sudo apt-get update -q
       - run: sudo apt-get install -y qemu-user-static
 
       - run: |
@@ -142,23 +234,46 @@ jobs:
 
       - run: make CLI/linux-static-armv7
 
-      - run: ./E2E/ooniprobe.bash ./CLI/ooniprobe-linux-armv7
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-linux-armv7
+          path: ./CLI/ooniprobe-linux-armv7
 
-      - run: ./script/ghpublish.bash ./CLI/ooniprobe-linux-armv7 ./CLI/miniooni-linux-armv7
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-linux-armv7
+          path: ./CLI/miniooni-linux-armv7
 
-  build_and_publish_arm64:
-    runs-on: "ubuntu-20.04"
-    permissions: # See https://github.com/ooni/probe/issues/2154
+  publish_linux_cli_armv7:
+    runs-on: ubuntu-20.04
+    needs: build_linux_cli_armv7
+    permissions:
       contents: write
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
 
-      - run: sudo apt-get update -q
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-linux-armv7
 
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-linux-armv7
+
+      - run: ./script/ghpublish.bash ooniprobe-linux-armv7 miniooni-linux-armv7
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build_linux_cli_arm64:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - run: sudo apt-get update -q
       - run: sudo apt-get install -y qemu-user-static
 
       - run: |
@@ -175,8 +290,36 @@ jobs:
 
       - run: make CLI/linux-static-arm64
 
-      - run: ./E2E/ooniprobe.bash ./CLI/ooniprobe-linux-arm64
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-linux-arm64
+          path: ./CLI/ooniprobe-linux-arm64
 
-      - run: ./script/ghpublish.bash ./CLI/ooniprobe-linux-arm64 ./CLI/miniooni-linux-arm64
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-linux-arm64
+          path: ./CLI/miniooni-linux-arm64
+
+  publish_linux_cli_arm64:
+    runs-on: ubuntu-20.04
+    needs: build_linux_cli_arm64
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-linux-arm64
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-linux-arm64
+
+      - run: ./script/ghpublish.bash ooniprobe-linux-arm64 miniooni-linux-arm64
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+# End of autogenerated file
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index a90106d..1cec184 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -1,22 +1,21 @@
-# Builds ooniprobe for macos
+# File generated by `go run ./GHGEN`; DO NOT EDIT.
+
 name: macos
 on:
   push:
     branches:
       - "release/**"
       - "fullbuild"
+      - "macosbuild"
     tags:
       - "v*"
   schedule:
     - cron: "17 1 * * *"
 
 jobs:
-  build_and_publish:
-    runs-on: "macos-11"
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      contents: write
+  build_darwin_cli:
+    runs-on: macos-11
     steps:
-
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
@@ -24,7 +23,6 @@ jobs:
       - name: Get GOVERSION content
         id: goversion
         run: echo ::set-output name=version::$(cat GOVERSION)
-
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
@@ -39,12 +37,70 @@ jobs:
 
       - run: make CLI/darwin
 
-      - run: ./E2E/ooniprobe.bash ./CLI/ooniprobe-darwin-amd64
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-darwin-amd64
+          path: ./CLI/ooniprobe-darwin-amd64
 
-      - run: |
-          ./script/ghpublish.bash ./CLI/ooniprobe-darwin-amd64 \
-                                  ./CLI/ooniprobe-darwin-arm64 \
-                                  ./CLI/miniooni-darwin-amd64 \
-                                  ./CLI/miniooni-darwin-arm64
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-darwin-arm64
+          path: ./CLI/ooniprobe-darwin-arm64
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-darwin-amd64
+          path: ./CLI/miniooni-darwin-amd64
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-darwin-arm64
+          path: ./CLI/miniooni-darwin-arm64
+
+  test_darwin_cli:
+    runs-on: macos-11
+    needs: build_darwin_cli
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-darwin-amd64
+
+      - run: chmod +x ooniprobe-darwin-amd64
+      - run: ./E2E/ooniprobe.bash ./ooniprobe-darwin-amd64
+        shell: bash
+
+  publish_darwin_cli:
+    runs-on: macos-11
+    needs: test_darwin_cli
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-darwin-amd64
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-darwin-arm64
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-darwin-amd64
+
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-darwin-arm64
+
+      - run: ./script/ghpublish.bash ooniprobe-darwin-amd64 ooniprobe-darwin-arm64 miniooni-darwin-amd64 miniooni-darwin-arm64
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+# End of autogenerated file
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 946f15e..47b7fb5 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -1,18 +1,20 @@
-# Builds ooniprobe for Windows and publishes binaries.
+# File generated by `go run ./GHGEN`; DO NOT EDIT.
+
 name: windows
 on:
   push:
     branches:
       - "release/**"
       - "fullbuild"
+      - "windowsbuild"
     tags:
       - "v*"
   schedule:
     - cron: "17 1 * * *"
 
 jobs:
-  build:
-    runs-on: "ubuntu-20.04"
+  build_windows_cli:
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
         with:
@@ -21,13 +23,14 @@ jobs:
       - name: Get GOVERSION content
         id: goversion
         run: echo ::set-output name=version::$(cat GOVERSION)
-
       - uses: magnetikonline/action-golang-cache@v2
         with:
           go-version: "${{ steps.goversion.outputs.version }}"
           cache-key-suffix: "-windows-${{ steps.goversion.outputs.version }}"
 
-      - run: sudo apt install mingw-w64
+      - run: sudo apt-get update -q
+      - run: sudo apt-get install -y mingw-w64
+
       - run: |
           echo -n $PSIPHON_CONFIG_KEY > ./internal/engine/psiphon-config.key
           echo $PSIPHON_CONFIG_JSON_AGE_BASE64 | base64 -d > ./internal/engine/psiphon-config.json.age
@@ -37,74 +40,69 @@ jobs:
 
       - run: make EXPECTED_MINGW_W64_VERSION="9.3-win32" CLI/windows
 
-      - uses: actions/upload-artifact@v2
-        with:
-          name: ooniprobe-windows-amd64.exe
-          path: ./CLI/ooniprobe-windows-amd64.exe
-
-      - uses: actions/upload-artifact@v2
-        with:
-          name: miniooni-windows-amd64.exe
-          path: ./CLI/miniooni-windows-amd64.exe
-
       - uses: actions/upload-artifact@v2
         with:
           name: ooniprobe-windows-386.exe
           path: ./CLI/ooniprobe-windows-386.exe
 
+      - uses: actions/upload-artifact@v2
+        with:
+          name: ooniprobe-windows-amd64.exe
+          path: ./CLI/ooniprobe-windows-amd64.exe
+
       - uses: actions/upload-artifact@v2
         with:
           name: miniooni-windows-386.exe
           path: ./CLI/miniooni-windows-386.exe
 
-  test:
-    needs: build
-    runs-on: "windows-2019"
-    permissions: # See https://github.com/ooni/probe/issues/2154
-      actions: read
+      - uses: actions/upload-artifact@v2
+        with:
+          name: miniooni-windows-amd64.exe
+          path: ./CLI/miniooni-windows-amd64.exe
+
+  test_windows_cli:
+    runs-on: windows-2019
+    needs: build_windows_cli
     steps:
       - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
 
       - uses: actions/download-artifact@v2
         with:
           name: ooniprobe-windows-amd64.exe
 
-      - uses: actions/download-artifact@v2
-        with:
-          name: miniooni-windows-amd64.exe
+      - run: ./E2E/ooniprobe.bash ./ooniprobe-windows-amd64.exe
+        shell: bash
 
-      - run: bash.exe ./E2E/ooniprobe.bash ./ooniprobe-windows-amd64.exe
-
-  publish:
-    needs: test
-    runs-on: "ubuntu-20.04"
-    permissions: # See https://github.com/ooni/probe/issues/2154
+  publish_windows_cli:
+    runs-on: ubuntu-20.04
+    needs: test_windows_cli
+    permissions:
       contents: write
-      actions: read
-
     steps:
       - uses: actions/checkout@v2
-
-      - uses: actions/download-artifact@v2
         with:
-          name: ooniprobe-windows-amd64.exe
-
-      - uses: actions/download-artifact@v2
-        with:
-          name: miniooni-windows-amd64.exe
+          fetch-depth: 0
 
       - uses: actions/download-artifact@v2
         with:
           name: ooniprobe-windows-386.exe
 
+      - uses: actions/download-artifact@v2
+        with:
+          name: ooniprobe-windows-amd64.exe
+
       - uses: actions/download-artifact@v2
         with:
           name: miniooni-windows-386.exe
 
-      - run: |
-          ./script/ghpublish.bash ooniprobe-windows-386.exe \
-                                  ooniprobe-windows-amd64.exe \
-                                  miniooni-windows-386.exe \
-                                  miniooni-windows-amd64.exe
+      - uses: actions/download-artifact@v2
+        with:
+          name: miniooni-windows-amd64.exe
+
+      - run: ./script/ghpublish.bash ooniprobe-windows-386.exe ooniprobe-windows-amd64.exe miniooni-windows-386.exe miniooni-windows-amd64.exe
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+# End of autogenerated file
diff --git a/GHGEN/android.go b/GHGEN/android.go
new file mode 100644
index 0000000..4f2db36
--- /dev/null
+++ b/GHGEN/android.go
@@ -0,0 +1,61 @@
+package main
+
+//
+// Generates Android workflow.
+//
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/ooni/probe-cli/v3/internal/runtimex"
+)
+
+func buildAndPublishMobileAndroid(w io.Writer, job *Job) {
+	runtimex.Assert(len(job.ArchsMatrix) <= 0, "expected no architecture matrix")
+
+	buildJob := "build_android_mobile"
+	artifacts := []string{
+		"./MOBILE/android/oonimkall.aar",
+		"./MOBILE/android/oonimkall-sources.jar",
+		"./MOBILE/android/oonimkall.pom",
+	}
+	publishJob := "publish_android_mobile"
+
+	newJob(w, buildJob, runsOnUbuntu, noDependencies, noPermissions)
+	newStepCheckout(w)
+	newStepSetupGo(w, "android-oonimkall")
+	newStepSetupPsiphon(w)
+	newStepMake(w, "MOBILE/android")
+	newStepUploadArtifacts(w, artifacts)
+
+	newJob(w, publishJob, runsOnUbuntu, buildJob, contentsWritePermissions)
+	newStepCheckout(w)
+	newStepDownloadArtifacts(w, artifacts)
+	newStepGHPublish(w, artifacts)
+}
+
+func buildAndPublishCLIAndroid(w io.Writer, job *Job) {
+	runtimex.Assert(len(job.ArchsMatrix) > 0, "expected architecture matrix")
+
+	for _, arch := range job.ArchsMatrix {
+		buildJob := fmt.Sprintf("build_android_cli_%s", arch)
+		artifacts := []string{
+			fmt.Sprintf("./CLI/miniooni-android-%s", arch),
+			fmt.Sprintf("./CLI/ooniprobe-android-%s", arch),
+		}
+		publishJob := fmt.Sprintf("publish_android_cli_%s", arch)
+
+		newJob(w, buildJob, runsOnUbuntu, noDependencies, noPermissions)
+		newStepCheckout(w)
+		newStepSetupGo(w, fmt.Sprintf("android-cli-%s", arch))
+		newStepSetupPsiphon(w)
+		newStepMake(w, fmt.Sprintf("CLI/android-%s", arch))
+		newStepUploadArtifacts(w, artifacts)
+
+		newJob(w, publishJob, runsOnUbuntu, buildJob, contentsWritePermissions)
+		newStepCheckout(w)
+		newStepDownloadArtifacts(w, artifacts)
+		newStepGHPublish(w, artifacts)
+	}
+}
diff --git a/GHGEN/config.go b/GHGEN/config.go
new file mode 100644
index 0000000..8ccc69d
--- /dev/null
+++ b/GHGEN/config.go
@@ -0,0 +1,76 @@
+package main
+
+//
+// Configuration with which we will run
+//
+
+import "io"
+
+// Job is a job to run.
+type Job struct {
+	// Action is the job name
+	Action func(w io.Writer, job *Job)
+
+	// ArchsMatrix contains the architectures to iterate over
+	ArchsMatrix []string
+}
+
+// Config contains the configuration.
+var Config = map[string][]Job{
+	"android": {{
+		Action:      buildAndPublishMobileAndroid,
+		ArchsMatrix: []string{},
+	}, {
+		Action: buildAndPublishCLIAndroid,
+		ArchsMatrix: []string{
+			"386",
+			"amd64",
+			"arm",
+			"arm64",
+		},
+	}},
+	"ios": {{
+		Action:      buildAndPublishMobileIOS,
+		ArchsMatrix: []string{},
+	}},
+	"linux": {{
+		Action: buildAndPublishCLILinux,
+		ArchsMatrix: []string{
+			"386",
+			"amd64",
+			"armv6",
+			"armv7",
+			"arm64",
+		},
+	}},
+	"macos": {{
+		Action:      buildAndPublishCLIMacOS,
+		ArchsMatrix: []string{},
+	}},
+	"windows": {{
+		Action:      buildAndPublishCLIWindows,
+		ArchsMatrix: []string{},
+	}},
+}
+
+const (
+	// runOnUbuntu is the Ubuntu system where to run.
+	runsOnUbuntu = "ubuntu-20.04"
+
+	// runsOnMacOS is the macOS system where to run.
+	runsOnMacOS = "macos-11"
+
+	// runsOnWindows is the windows system where to run.
+	runsOnWindows = "windows-2019"
+)
+
+// noPermission indicates a job does not require permissions.
+var noPermissions map[string]string
+
+// contentsWritePermissions indicates the job needs the `contents: write` permission.
+var contentsWritePermissions = map[string]string{
+	"contents": "write",
+}
+
+// noDependencies indicates a job does not require dependencies.
+var noDependencies string
diff --git a/GHGEN/ios.go b/GHGEN/ios.go
new file mode 100644
index 0000000..0f238fa
--- /dev/null
+++ b/GHGEN/ios.go
@@ -0,0 +1,34 @@
+package main
+
+//
+// Generates iOS workflow.
+//
+
+import (
+	"io"
+
+	"github.com/ooni/probe-cli/v3/internal/runtimex"
+)
+
+func buildAndPublishMobileIOS(w io.Writer, job *Job) {
+	runtimex.Assert(len(job.ArchsMatrix) <= 0, "expected no architecture matrix")
+
+	buildJob := "build_ios_mobile"
+	artifacts := []string{
+		"./MOBILE/ios/oonimkall.xcframework.zip",
+		"./MOBILE/ios/oonimkall.podspec",
+	}
+	publishJob := "publish_ios_mobile"
+
+	newJob(w, buildJob, runsOnMacOS, noDependencies, noPermissions)
+	newStepCheckout(w)
+	newStepSetupGo(w, "ios")
+	newStepSetupPsiphon(w)
+	newStepMake(w, "EXPECTED_XCODE_VERSION=13.2.1 MOBILE/ios")
+	newStepUploadArtifacts(w, artifacts)
+
+	newJob(w, publishJob, runsOnUbuntu, buildJob, contentsWritePermissions)
+	newStepCheckout(w)
+	newStepDownloadArtifacts(w, artifacts)
+	newStepGHPublish(w, artifacts)
+}
diff --git a/GHGEN/linux.go b/GHGEN/linux.go
new file mode 100644
index 0000000..43541be
--- /dev/null
+++ b/GHGEN/linux.go
@@ -0,0 +1,58 @@
+package main
+
+//
+// Generates Linux workflow.
+//
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/ooni/probe-cli/v3/internal/runtimex"
+)
+
+func buildAndPublishCLILinux(w io.Writer, job *Job) {
+	runtimex.Assert(len(job.ArchsMatrix) > 0, "expected architecture matrix")
+
+	for _, arch := range job.ArchsMatrix {
+		buildJob := fmt.Sprintf("build_linux_cli_%s", arch)
+		artifacts := []string{
+			fmt.Sprintf("./CLI/ooniprobe-linux-%s", arch),
+			fmt.Sprintf("./CLI/miniooni-linux-%s", arch),
+		}
+		testJob := fmt.Sprintf("test_linux_cli_%s", arch)
+		publishJob := fmt.Sprintf("publish_linux_cli_%s", arch)
+
+		newJob(w, buildJob, runsOnUbuntu, noDependencies, noPermissions)
+		newStepCheckout(w)
+		switch arch {
+		case "386", "amd64":
+			// nothing
+		default:
+			newSetupInstallQemuUserStatic(w)
+		}
+		newStepSetupPsiphon(w)
+		newStepSetupLinuxDockerGoCache(w, arch)
+		newStepMake(w, fmt.Sprintf("CLI/linux-static-%s", arch))
+		newStepUploadArtifacts(w, artifacts)
+
+		// We only run integration tests for amd64
+		switch arch {
+		case "amd64":
+			newJob(w, testJob, runsOnUbuntu, buildJob, noPermissions)
+			newStepCheckout(w)
+			newStepDownloadArtifacts(w, artifacts)
+			newStepSetupGo(w, fmt.Sprintf("linux-%s", arch))
+			newStepInstallTor(w)
+			newStepRunOONIProbeIntegrationTests(w, "linux", arch, "")
+			newStepRunMiniooniIntegrationTests(w, "linux", arch, "")
+			newJob(w, publishJob, runsOnUbuntu, testJob, contentsWritePermissions)
+		default:
+			newJob(w, publishJob, runsOnUbuntu, buildJob, contentsWritePermissions)
+		}
+
+		newStepCheckout(w)
+		newStepDownloadArtifacts(w, artifacts)
+		newStepGHPublish(w, artifacts)
+	}
+}
diff --git a/GHGEN/macos.go b/GHGEN/macos.go
new file mode 100644
index 0000000..6f7e30e
--- /dev/null
+++ b/GHGEN/macos.go
@@ -0,0 +1,42 @@
+package main
+
+//
+// Generates the macOS workflow.
+//
+
+import (
+	"io"
+
+	"github.com/ooni/probe-cli/v3/internal/runtimex"
+)
+
+func buildAndPublishCLIMacOS(w io.Writer, job *Job) {
+	runtimex.Assert(len(job.ArchsMatrix) <= 0, "expected no architecture matrix")
+
+	buildJob := "build_darwin_cli"
+	artifacts := []string{
+		"./CLI/ooniprobe-darwin-amd64",
+		"./CLI/ooniprobe-darwin-arm64",
+		"./CLI/miniooni-darwin-amd64",
+		"./CLI/miniooni-darwin-arm64",
+	}
+	testJob := "test_darwin_cli"
+	publishJob := "publish_darwin_cli"
+
+	newJob(w, buildJob, runsOnMacOS, noDependencies, noPermissions)
+	newStepCheckout(w)
+	newStepSetupGo(w, "macos")
+	newStepSetupPsiphon(w)
+	newStepMake(w, "CLI/darwin")
+	newStepUploadArtifacts(w, artifacts)
+
+	newJob(w, testJob, runsOnMacOS, buildJob, noPermissions)
+	newStepCheckout(w)
+	newStepDownloadArtifacts(w, []string{"ooniprobe-darwin-amd64"})
+	newStepRunOONIProbeIntegrationTests(w, "darwin", "amd64", "")
+
+	newJob(w, publishJob, runsOnMacOS, testJob, contentsWritePermissions)
+	newStepCheckout(w)
+	newStepDownloadArtifacts(w, artifacts)
+	newStepGHPublish(w, artifacts)
+}
diff --git a/GHGEN/main.go b/GHGEN/main.go
new file mode 100644
index 0000000..1f6d93b
--- /dev/null
+++ b/GHGEN/main.go
@@ -0,0 +1,12 @@
+// Command GHGEN regenerates selected GitHub actions.
+package main
+
+import (
+	_ "embed"
+)
+
+func main() {
+	for name, jobs := range Config {
+		generateWorkflowFile(name, jobs)
+	}
+}
diff --git a/GHGEN/utils.go b/GHGEN/utils.go
new file mode 100644
index 0000000..f04c1b0
--- /dev/null
+++ b/GHGEN/utils.go
@@ -0,0 +1,177 @@
+package main
+
+//
+// Utility functions.
+//
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/ooni/probe-cli/v3/internal/runtimex"
+)
+
+func newJob(w io.Writer, name, runsOn, needs string, permissions map[string]string) {
+	mustFprintf(w, "  %s:\n", name)
+	mustFprintf(w, "    runs-on: %s\n", runsOn)
+	if needs != "" {
+		mustFprintf(w, "    needs: %s\n", needs)
+	}
+	if len(permissions) > 0 {
+		mustFprintf(w, "    permissions:\n")
+		for key, value := range permissions {
+			mustFprintf(w, "      %s: %s\n", key, value)
+		}
+	}
+	mustFprintf(w, "    steps:\n")
+}
+
+func newStepCheckout(w io.Writer) {
+	mustFprintf(w, "      - uses: actions/checkout@v2\n")
+	mustFprintf(w, "        with:\n")
+	mustFprintf(w, "          fetch-depth: 0\n")
+	mustFprintf(w, "\n")
+}
+
+func newStepSetupGo(w io.Writer, cacheName string) {
+	mustFprintf(w, "      - name: Get GOVERSION content\n")
+	mustFprintf(w, "        id: goversion\n")
+	mustFprintf(w, "        run: echo ::set-output name=version::$(cat GOVERSION)\n")
+	mustFprintf(w, "      - uses: magnetikonline/action-golang-cache@v2\n")
+	mustFprintf(w, "        with:\n")
+	mustFprintf(w, "          go-version: \"${{ steps.goversion.outputs.version }}\"\n")
+	mustFprintf(w, "          cache-key-suffix: \"-%s-${{ steps.goversion.outputs.version }}\"\n", cacheName)
+	mustFprintf(w, "\n")
+}
+
+func newStepSetupPsiphon(w io.Writer) {
+	mustFprintf(w, "      - run: |\n")
+	mustFprintf(w, "          echo -n $PSIPHON_CONFIG_KEY > ./internal/engine/psiphon-config.key\n")
+	mustFprintf(w, "          echo $PSIPHON_CONFIG_JSON_AGE_BASE64 | base64 -d > ./internal/engine/psiphon-config.json.age\n")
+	mustFprintf(w, "        env:\n")
+	mustFprintf(w, "          PSIPHON_CONFIG_KEY: ${{ secrets.PSIPHON_CONFIG_KEY }}\n")
+	mustFprintf(w, "          PSIPHON_CONFIG_JSON_AGE_BASE64: ${{ secrets.PSIPHON_CONFIG_JSON_AGE_BASE64 }}\n")
+	mustFprintf(w, "\n")
+}
+
+func newStepMake(w io.Writer, target string) {
+	mustFprintf(w, "      - run: make %s\n", target)
+	mustFprintf(w, "\n")
+}
+
+func newStepUploadArtifacts(w io.Writer, artifacts []string) {
+	for _, arti := range artifacts {
+		mustFprintf(w, "      - uses: actions/upload-artifact@v2\n")
+		mustFprintf(w, "        with:\n")
+		mustFprintf(w, "          name: %s\n", filepath.Base(arti))
+		mustFprintf(w, "          path: %s\n", arti)
+		mustFprintf(w, "\n")
+	}
+}
+
+func newStepDownloadArtifacts(w io.Writer, artifacts []string) {
+	for _, arti := range artifacts {
+		mustFprintf(w, "      - uses: actions/download-artifact@v2\n")
+		mustFprintf(w, "        with:\n")
+		mustFprintf(w, "          name: %s\n", filepath.Base(arti))
+		mustFprintf(w, "\n")
+	}
+}
+
+func newStepGHPublish(w io.Writer, artifacts []string) {
+	runtimex.Assert(len(artifacts) > 0, "expected at least one artifact")
+	artifactsNames := []string{}
+	for _, arti := range artifacts {
+		artifactsNames = append(artifactsNames, filepath.Base(arti))
+	}
+	mustFprintf(w, "      - run: ./script/ghpublish.bash %s\n", strings.Join(artifactsNames, " "))
+	mustFprintf(w, "        env:\n")
+	mustFprintf(w, "          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n")
+	mustFprintf(w, "\n")
+}
+
+func newStepSetupLinuxDockerGoCache(w io.Writer, name string) {
+	mustFprintf(w, "      - uses: actions/cache@v3\n")
+	mustFprintf(w, "        with:\n")
+	mustFprintf(w, "          path: GOCACHE\n")
+	mustFprintf(w, "          key: linux-build-cache-%s\n", name)
+	mustFprintf(w, "\n")
+
+}
+
+func newSetupInstallQemuUserStatic(w io.Writer) {
+	mustFprintf(w, "      - run: sudo apt-get update -q\n")
+	mustFprintf(w, "      - run: sudo apt-get install -y qemu-user-static\n")
+	mustFprintf(w, "\n")
+}
+
+func newStepInstallTor(w io.Writer) {
+	mustFprintf(w, "      - run: sudo apt-get update -q\n")
+	mustFprintf(w, "      - run: sudo apt-get install -y tor\n")
+	mustFprintf(w, "\n")
+}
+
+func newStepRunOONIProbeIntegrationTests(w io.Writer, os, arch, ext string) {
+	executable := fmt.Sprintf("ooniprobe-%s-%s%s", os, arch, ext)
+	if os != "windows" {
+		mustFprintf(w, "      - run: chmod +x %s\n", executable)
+	}
+	mustFprintf(w, "      - run: ./E2E/ooniprobe.bash ./%s\n", executable)
+	mustFprintf(w, "        shell: bash\n")
+	mustFprintf(w, "\n")
+}
+
+func newStepRunMiniooniIntegrationTests(w io.Writer, os, arch, ext string) {
+	executable := fmt.Sprintf("miniooni-%s-%s%s", os, arch, ext)
+	if os != "windows" {
+		mustFprintf(w, "      - run: chmod +x %s\n", executable)
+	}
+	mustFprintf(w, "      - run: ./E2E/miniooni.bash ./%s\n", executable)
+	mustFprintf(w, "        shell: bash\n")
+	mustFprintf(w, "\n")
+}
+
+func newStepInstallMingwW64(w io.Writer) {
+	mustFprintf(w, "      - run: sudo apt-get update -q\n")
+	mustFprintf(w, "      - run: sudo apt-get install -y mingw-w64\n")
+	mustFprintf(w, "\n")
+}
+
+func mustFprintf(w io.Writer, format string, v ...any) {
+	_, err := fmt.Fprintf(w, format, v...)
+	runtimex.PanicOnError(err, "fmt.Fprintf failed")
+}
+
+func mustClose(c io.Closer) {
+	err := c.Close()
+	runtimex.PanicOnError(err, "c.Close failed")
+}
+
+func generateWorkflowFile(name string, jobs []Job) {
+	filename := filepath.Join(".github", "workflows", name+".yml")
+	fp, err := os.Create(filename)
+	runtimex.PanicOnError(err, "os.Create failed")
+	defer mustClose(fp)
+	mustFprintf(fp, "# File generated by `go run ./GHGEN`; DO NOT EDIT.\n")
+	mustFprintf(fp, "\n")
+	mustFprintf(fp, "name: %s\n", name)
+	mustFprintf(fp, "on:\n")
+	mustFprintf(fp, "  push:\n")
+	mustFprintf(fp, "    branches:\n")
+	mustFprintf(fp, "      - \"release/**\"\n")
+	mustFprintf(fp, "      - \"fullbuild\"\n")
+	mustFprintf(fp, "      - \"%sbuild\"\n", name)
+	mustFprintf(fp, "    tags:\n")
+	mustFprintf(fp, "      - \"v*\"\n")
+	mustFprintf(fp, "  schedule:\n")
+	mustFprintf(fp, "    - cron: \"17 1 * * *\"\n")
+	mustFprintf(fp, "\n")
+	mustFprintf(fp, "jobs:\n")
+	for _, job := range jobs {
+		job.Action(fp, &job)
+	}
+	mustFprintf(fp, "# End of autogenerated file\n")
+}
diff --git a/GHGEN/windows.go b/GHGEN/windows.go
new file mode 100644
index 0000000..e4eb7e5
--- /dev/null
+++ b/GHGEN/windows.go
@@ -0,0 +1,44 @@
+package main
+
+//
+// Generates the Windows workflow.
+//
+
+import (
+	"io"
+
+	"github.com/ooni/probe-cli/v3/internal/runtimex"
+)
+
+func buildAndPublishCLIWindows(w io.Writer, job *Job) {
+	runtimex.Assert(len(job.ArchsMatrix) <= 0, "expected no architecture matrix")
+
+	buildJob := "build_windows_cli"
+	artifacts := []string{
+		"./CLI/ooniprobe-windows-386.exe",
+		"./CLI/ooniprobe-windows-amd64.exe",
+		"./CLI/miniooni-windows-386.exe",
+		"./CLI/miniooni-windows-amd64.exe",
+	}
+	testJob := "test_windows_cli"
+	publishJob := "publish_windows_cli"
+
+	newJob(w, buildJob, runsOnUbuntu, noDependencies, noPermissions)
+	newStepCheckout(w)
+	newStepSetupGo(w, "windows")
+	newStepInstallMingwW64(w)
+	newStepSetupPsiphon(w)
+	newStepMake(w, "EXPECTED_MINGW_W64_VERSION=\"9.3-win32\" CLI/windows")
+
+	newStepUploadArtifacts(w, artifacts)
+
+	newJob(w, testJob, runsOnWindows, buildJob, noPermissions)
+	newStepCheckout(w)
+	newStepDownloadArtifacts(w, []string{"ooniprobe-windows-amd64.exe"})
+	newStepRunOONIProbeIntegrationTests(w, "windows", "amd64", ".exe")
+
+	newJob(w, publishJob, runsOnUbuntu, testJob, contentsWritePermissions)
+	newStepCheckout(w)
+	newStepDownloadArtifacts(w, artifacts)
+	newStepGHPublish(w, artifacts)
+}
diff --git a/internal/cmd/ooporthelper/main_test.go b/internal/cmd/ooporthelper/main_test.go
index fe93c66..5f86292 100644
--- a/internal/cmd/ooporthelper/main_test.go
+++ b/internal/cmd/ooporthelper/main_test.go
@@ -10,6 +10,7 @@ import (
 )
 
 func TestMainWorkingAsIntended(t *testing.T) {
+	t.Skip("// TODO(https://github.com/ooni/probe/issues/2338)")
 	srvTest = true // toggle to imply that we are running in test mode
 	go main()
 	dialer := netxlite.NewDialerWithoutResolver(model.DiscardLogger)