diff --git a/.travis.yml b/.travis.yml
index 8ae31a625..66c1dc889 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -115,6 +115,7 @@ after_success:
 
 before_deploy:
   - make release
+  - if [ "$TRAVIS_GOOS" = "linux" ]; then make cri-release; fi
 
 deploy:
   - provider: releases
@@ -145,7 +146,8 @@ deploy:
     file:
       - releases/cri/*.tar.gz
       - releases/cri/*.tar.gz.sha256
-    # TODO: only deploy on tag after testing.
-    #on:
-    #  repo: containerd/containerd
-    #  tags: true
+    on:
+      repo: containerd/containerd
+      # TODO: switch `tags: true` after validating on master
+      branch: master
+      condition: $TRAVIS_GOOS = linux
diff --git a/Makefile b/Makefile
index 0bcdaf681..84ea38938 100644
--- a/Makefile
+++ b/Makefile
@@ -216,13 +216,20 @@ install-man:
 	@echo "$(WHALE) $@"
 	$(foreach manpage,$(addprefix man/,$(MANPAGES)), $(call installmanpage,$(manpage),$(subst .,,$(suffix $(manpage))),$(notdir $(manpage))))
 
-release: $(BINARIES)
+releases/$(RELEASE).tar.gz: $(BINARIES)
 	@echo "$(WHALE) $@"
 	@rm -rf releases/$(RELEASE) releases/$(RELEASE).tar.gz
 	@install -d releases/$(RELEASE)/bin
 	@install $(BINARIES) releases/$(RELEASE)/bin
-	@cd releases/$(RELEASE) && tar -czf ../$(RELEASE).tar.gz *
+	@tar -czf releases/$(RELEASE).tar.gz -C releases/$(RELEASE) bin
+	@rm -rf releases/$(RELEASE)
+
+release: $(BINARIES) releases/$(RELEASE).tar.gz
+	@echo "$(WHALE) $@"
 	@cd releases && sha256sum $(RELEASE).tar.gz >$(RELEASE).tar.gz.sha256sum
+
+cri-release: $(BINARIES) releases/$(RELEASE).tar.gz
+	@echo "$(WHALE) $@"
 	@VERSION=$(VERSION:v%=%) script/release/release-cri
 
 clean: ## clean up binaries