diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..de18868
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,19 @@
+on:
+  release:
+    types: [created]
+
+permissions:
+    contents: write
+    packages: write
+
+jobs:
+  release-linux-amd64:
+    name: release linux/amd64
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - uses: wangyoucao577/go-release-action@v1
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        goos: linux
+        goarch: amd64
\ No newline at end of file
diff --git a/cmd/server/main.go b/cmd/server/main.go
index d400ed7..6685729 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"net/http"
 	"os"
 	"time"
@@ -17,6 +18,11 @@ import (
 	"github.com/stillmatic/featuresheet/gen/featuresheet/v1/featuresheetv1connect"
 )
 
+const (
+	featureSheetVersionKey   = "FeatureSheet-Version"
+	featureSheetVersionValue = "v1"
+)
+
 type FeatureSheetServer struct {
 	fs *featuresheet.FeatureSheet
 }
@@ -35,17 +41,31 @@ func (s *FeatureSheetServer) Evaluate(
 	res := connect.NewResponse(&fsv1.EvaluateResponse{
 		Variant: string(fv),
 	})
-	res.Header().Set("FeatureSheet-Version", "v1")
+	res.Header().Set(featureSheetVersionKey, featureSheetVersionValue)
 	return res, nil
 }
 
 func main() {
-	data, err := os.ReadFile("client_secret.json")
+	// copy these from client_secret.json
+	serviceAccountJSON := map[string]interface{}{
+		"type":                        "service_account",
+		"project_id":                  os.Getenv("GCP_PROJECT_ID"),
+		"private_key_id":              os.Getenv("GCP_PRIVATE_KEY_ID"),
+		"private_key":                 os.Getenv("GCP_PRIVATE_KEY"),
+		"client_email":                os.Getenv("GCP_CLIENT_EMAIL"),
+		"client_id":                   os.Getenv("GCP_CLIENT_ID"),
+		"auth_uri":                    os.Getenv("GCP_AUTH_URI"),
+		"token_uri":                   os.Getenv("GCP_TOKEN_URI"),
+		"auth_provider_x509_cert_url": os.Getenv("GCP_AUTH_PROVIDER_CERT_URL"),
+		"client_x509_cert_url":        os.Getenv("GCP_CLIENT_CERT_URL"),
+	}
+
+	serviceAccountJSONBytes, err := json.Marshal(serviceAccountJSON)
 	if err != nil {
 		panic(err)
 	}
 
-	conf, err := google.JWTConfigFromJSON(data, spreadsheet.Scope)
+	conf, err := google.JWTConfigFromJSON(serviceAccountJSONBytes, spreadsheet.Scope)
 	if err != nil {
 		panic(err)
 	}
@@ -54,7 +74,7 @@ func main() {
 		panic("SPREADSHEET_ID env var must be set")
 	}
 
-	client := conf.Client(context.TODO())
+	client := conf.Client(context.Background())
 	service := spreadsheet.NewServiceWithClient(client)
 	fs, err := featuresheet.NewFeatureSheet(service, spreadsheetID, 10*time.Second)
 	if err != nil {