diff --git a/.github/workflows/build-caddy.yaml b/.github/workflows/build-caddy.yaml
index 8f0fceb..cc2bddd 100644
--- a/.github/workflows/build-caddy.yaml
+++ b/.github/workflows/build-caddy.yaml
@@ -40,4 +40,16 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: caddy-custom-linux-amd64
-          path: caddy
\ No newline at end of file
+          path: caddy
+
+      - name: Upload binary to S3
+        if: ${{ vars.S3_BUCKET != '' }}
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_KEY }}
+          AWS_DEFAULT_REGION: ${{ vars.S3_REGION || 'cn-hongkong' }}
+        run: |
+          aws configure set default.s3.addressing_style virtual
+          aws s3 cp caddy "s3://${{ vars.S3_BUCKET }}/caddy-${{ inputs.caddy_version }}-linux-amd64" \
+            --endpoint-url "${{ vars.S3_ENDPOINT }}" \
+            --no-progress
\ No newline at end of file
diff --git a/README.md b/README.md
index d584b0d..50c07d0 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,22 @@ The table below shows how the value of `caddy_plugin` maps to the actual `xcaddy
 
 > Empty entries are skipped automatically, so `plugin1, , plugin2` behaves the same as `plugin1, plugin2`.
 
+### Uploading to S3-compatible storage
+
+When the `S3_BUCKET` variable is set, the compiled binary is also uploaded to any S3-compatible object storage as `caddy-<version>-linux-amd64`. Leaving `S3_BUCKET` unset skips this step.
+
+Configure the repository settings (**Settings → Secrets and variables → Actions**):
+
+| Kind | Name | Description |
+|------|------|-------------|
+| Variable | `S3_ENDPOINT` | Endpoint of your S3-compatible service, e.g. `https://tos-s3-cn-hongkong.volces.com` (Volcano TOS), `https://s3.amazonaws.com`, or a MinIO/R2 endpoint |
+| Variable | `S3_REGION` | S3 region used for signing, e.g. `cn-hongkong`, `us-east-1` (defaults to `cn-hongkong` if unset) |
+| Variable | `S3_BUCKET` | Bucket to upload to. Leave unset to skip the upload |
+| Secret | `S3_ACCESS_KEY` | AccessKey ID |
+| Secret | `S3_SECRET_KEY` | AccessKey Secret |
+
+The upload uses the AWS CLI with the endpoint from `S3_ENDPOINT`, VirtualHostStyle addressing and SigV4 signing. The key needs write permission on the bucket. Note that a few providers (e.g. MinIO in path-style mode) require `path` addressing instead of `virtual` — edit the `aws configure set default.s3.addressing_style` line in the workflow accordingly.
+
 ## Building locally
 
 To reproduce the same build on your own machine you need Go 1.22+: