diff --git a/.github/workflows/checksum.yml b/.github/workflows/checksum.yml
new file mode 100644
index 0000000..3110cee
--- /dev/null
+++ b/.github/workflows/checksum.yml
@@ -0,0 +1,37 @@
+name: Generate & Attach SHA256 Checksum
+
+on:
+  push:
+    branches: [main]
+  release:
+    types: [published]
+
+jobs:
+  generate-sha256:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Generate SHA256
+        run: |
+          sha256sum setup_harden_debian_ubuntu.sh > setup_harden_debian_ubuntu.sh.sha256
+
+      - name: Commit SHA256 (only on push to main)
+        if: github.event_name == 'push'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add setup_harden_debian_ubuntu.sh.sha256
+          git commit -m "Auto-update SHA256 checksum"
+          git push
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SHA256 to GitHub Release (only on release)
+        if: github.event_name == 'release'
+        uses: softprops/action-gh-release@v1
+        with:
+          files: setup_harden_debian_ubuntu.sh.sha256
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}