diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml
index 3e79b7d7..a0d6210b 100644
--- a/.github/workflows/artifacts.yaml
+++ b/.github/workflows/artifacts.yaml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Build rusts-ffi
         run: |
-          cargo cinstall --features cert_compression --release --prefix dist --target x86_64-pc-windows-msvc
+          cargo cinstall --locked --target x86_64-pc-windows-msvc --features cert_compression --release --prefix dist
 
       - name: Upload binaries
         uses: actions/upload-artifact@v4
@@ -68,6 +68,32 @@ jobs:
           name: rustls-ffi-x86_64-linux-gnu
           path: dist
 
+  linux-deb:
+    runs-on: ubuntu-20.04 # x86_64. Using older Ubuntu for greater GLIBC compat.
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-c (Ubuntu)
+        env:
+          LINK: https://github.com/lu-zero/cargo-c/releases/latest/download
+          CARGO_C_FILE: cargo-c-x86_64-unknown-linux-musl.tar.gz
+        run: |
+          curl -L $LINK/$CARGO_C_FILE | tar xz -C ~/.cargo/bin
+
+      - name: Build deb
+        run: ./debian/build.sh
+
+      - name: Upload deb
+        uses: actions/upload-artifact@v4
+        with:
+          name: librustls_0.15.0_amd64.deb
+          path: librustls_0.15.0_amd64.deb
+
   macos-binaries-arm64:
     runs-on: macos-14 # arm64.
     steps:
@@ -88,7 +114,7 @@ jobs:
 
       - name: Build rusts-ffi
         run: |
-          cargo cinstall --features cert_compression --release --prefix dist
+          cargo cinstall --locked --features cert_compression --release --prefix dist
 
       - name: Fix rpath
         run: |
@@ -116,7 +142,7 @@ jobs:
 
       - name: Build rusts-ffi
         run: |
-          cargo cinstall --features cert_compression --release --prefix dist
+          cargo cinstall --locked --features cert_compression --release --prefix dist
 
       - name: Fix rpath
         run: |
diff --git a/.gitignore b/.gitignore
index b675f021..cdb92b1e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,5 @@ librustls/cmake-build*
 .idea
 .venv
 .vs
+debian/usr
+debian/DEBIAN
diff --git a/debian/build.sh b/debian/build.sh
new file mode 100755
index 00000000..0de3c9e5
--- /dev/null
+++ b/debian/build.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -eu
+set -x
+
+cd "$(dirname "$0")"
+
+VERSION=$(sed -n 's/^version = "\(.*\)"$/\1/p' ../librustls/Cargo.toml)
+if [ -z "$VERSION" ]; then
+    echo "Failed to extract version from Cargo.toml" >&2
+    exit 1
+fi
+
+PACKAGE="librustls"
+ARCH="amd64"
+DIST_DIR="/tmp/dist"
+DEB_ROOT="."
+
+CC=clang CXX=clang cargo cinstall --locked --features cert_compression --release --prefix "${DIST_DIR}"
+
+mkdir -p "${DEB_ROOT}/usr/"{lib,include}
+mkdir -p "${DEB_ROOT}/DEBIAN"
+
+cp -r "${DIST_DIR}/lib/"* "${DEB_ROOT}/usr/lib/"
+cp -r "${DIST_DIR}/include/"* "${DEB_ROOT}/usr/include/"
+
+sed -i "s|prefix=.*|prefix=/usr|" "${DEB_ROOT}/usr/lib/x86_64-linux-gnu/pkgconfig/rustls.pc"
+
+cat > "${DEB_ROOT}/DEBIAN/control" << EOF
+Package: ${PACKAGE}
+Version: ${VERSION}
+Architecture: ${ARCH}
+Maintainer: Daniel McCarney <daniel@binaryparadox.net>
+Description: FFI bindings for the Rustls TLS library
+Section: libs
+Depends: libc6
+Priority: optional
+EOF
+
+cat > "${DEB_ROOT}/DEBIAN/postinst" << EOF
+#!/bin/sh
+set -e
+ldconfig
+EOF
+chmod 755 "${DEB_ROOT}/DEBIAN/postinst"
+
+cd ..
+dpkg-deb --build debian "${PACKAGE}_${VERSION}_${ARCH}.deb"