diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9edba425993..2e6b80c831f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -20,6 +20,7 @@ env:
   GOFUMPT_VERSION: 0.6.0
   GOLANGCI_LINT_VERSION: 1.58.1
   GOLINES_VERSION: 0.12.2
+  GORELEASER_VERSION: 1.26.0
   GOVERSIONINFO_VERSION: 1.4.0
   RAGE_VERSION: 0.10.0
 jobs:
@@ -200,7 +201,7 @@ jobs:
       if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
       uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811
       with:
-        version: latest
+        version: ${{ env.GORELEASER_VERSION }}
         args: release --skip=sign --snapshot --timeout=1h
     - name: upload-artifact-chezmoi-darwin-amd64
       if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
@@ -423,7 +424,7 @@ jobs:
         make create-syso
     - uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811
       with:
-        version: latest
+        version: ${{ env.GORELEASER_VERSION }}
         args: release --timeout=1h
       env:
         CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
diff --git a/.gitignore b/.gitignore
index 15197d1b2ea..c57c20c68d0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@
 /bin/gofumpt
 /bin/golines
 /bin/golangci-lint
+/bin/goreleaser
 /bin/goversioninfo
 /chezmoi
 /chezmoi.exe
diff --git a/Makefile b/Makefile
index 3255247162c..8a9b27fe344 100644
--- a/Makefile
+++ b/Makefile
@@ -7,6 +7,7 @@ FIND_TYPOS_VERSION=$(shell awk '/FIND_TYPOS_VERSION:/ { print $$2 }' .github/wor
 GOFUMPT_VERSION=$(shell awk '/GOFUMPT_VERSION:/ { print $$2 }' .github/workflows/main.yml)
 GOLANGCI_LINT_VERSION=$(shell awk '/GOLANGCI_LINT_VERSION:/ { print $$2 }' .github/workflows/main.yml)
 GOLINES_VERSION=$(shell awk '/GOLINES_VERSION:/ { print $$2 }' .github/workflows/main.yml)
+GORELEASER_VERSION=$(shell awk '/GORELEASER_VERSION:/ { print $$2 }' .github/workflows/main.yml)
 GOVERSIONINFO_VERSION=$(shell awk '/GOVERSIONINFO_VERSION:/ { print $$2 }' .github/workflows/main.yml)
 ifdef VERSION
 	GO_LDFLAGS+=-X main.version=${VERSION}
@@ -137,7 +138,14 @@ create-syso: ensure-goversioninfo
 	./bin/goversioninfo -platform-specific
 
 .PHONY: ensure-tools
-ensure-tools: ensure-actionlint ensure-find-typos ensure-gofumpt ensure-golangci-lint ensure-golines ensure-goversioninfo
+ensure-tools: \
+	ensure-actionlint \
+	ensure-find-typos \
+	ensure-gofumpt \
+	ensure-golangci-lint \
+	ensure-golines \
+	ensure-goreleaser \
+	ensure-goversioninfo
 
 .PHONY: ensure-actionlint
 ensure-actionlint:
@@ -180,6 +188,12 @@ ensure-golangci-lint:
 		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- v${GOLANGCI_LINT_VERSION} ; \
 	fi
 
+.PHONY: ensure-goreleaser
+ensure-goreleaser:
+	if [ ! -x bin/goreleaser ] || ( ./bin/goreleaser --version | grep -Fqv "${GORELEASER_VERSION}" ) ; then \
+		GOBIN=$(shell pwd)/bin ${GO} install "github.com/goreleaser/goreleaser@v${GORELEASER_VERSION}" ; \
+	fi
+
 .PHONY: ensure-goversioninfo
 ensure-goversioninfo:
 	if [ ! -x bin/goversioninfo ] ; then \
@@ -187,8 +201,8 @@ ensure-goversioninfo:
 	fi
 
 .PHONY: release
-release:
-	goreleaser release \
+release: ensure-goreleaser
+	./bin/goreleaser release \
 		--clean \
 		${GORELEASER_FLAGS}
 
@@ -197,8 +211,8 @@ shellcheck:
 	find . -type f -name \*.sh | xargs shellcheck
 
 .PHONY: test-release
-test-release:
-	goreleaser release \
+test-release: ensure-goreleaser
+	./bin/goreleaser release \
 		--clean \
 		--skip=chocolatey,sign \
 		--snapshot \