diff --git a/.github/workflows/build-publish-container-goreleaser.yml b/.github/workflows/build-publish-container-goreleaser.yml
index e2dc679..f518063 100644
--- a/.github/workflows/build-publish-container-goreleaser.yml
+++ b/.github/workflows/build-publish-container-goreleaser.yml
@@ -9,6 +9,10 @@ name: Build and publish container using goreleaser
 on:
   workflow_call:
     inputs:
+      build_deps:
+        type: string
+        required: false
+        description: 'Space-separated list of apt packages to install before building (e.g. "gcc-aarch64-linux-gnu libc6-dev-arm64-cross").'
       cgo_enabled:
         type: number
         required: false
@@ -41,6 +45,14 @@ jobs:
   container_build_publish:
     runs-on: ubuntu-latest
     steps:
+      - name: Install build dependencies
+        if: ${{ inputs.build_deps != '' }}
+        env:
+          BUILD_DEPS: ${{ inputs.build_deps }}
+        run: |
+          sudo apt update
+          # shellcheck disable=SC2086 # intentional word splitting
+          sudo apt install -y --no-install-recommends ${BUILD_DEPS}
       - name: Set up Go
         uses: actions/setup-go@v6.4.0
         with:
@@ -97,13 +109,18 @@ jobs:
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git tag -f -a pr-${{ inputs.pr_number }} -m "PR Release"
+      - name: Generate release notes
+        if: ${{ !inputs.is_pr_build }}
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: gh api "repos/${GITHUB_REPOSITORY}/releases/generate-notes" -F tag_name="${{ github.ref_name }}" --jq .body > ../notes.md
       - name: Build/Push/Release container with goreleaser
         uses: goreleaser/goreleaser-action@v6
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
           version: '~> 2'
-          args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}${{ env.SKIP_CONTAINER_PUBLISH == 'true' && (inputs.is_pr_build && ',publish' || '--skip=publish') || '' }}${{ inputs.release_draft && ' --draft' || '' }}
+          args: release --clean ${{ inputs.is_pr_build && '--skip=announce,validate,archive' || '' }}${{ env.SKIP_CONTAINER_PUBLISH == 'true' && (inputs.is_pr_build && ',publish' || '--skip=publish') || '' }} ${{ inputs.release_draft && '--draft' || '' }} ${{ !inputs.is_pr_build && '--release-notes ../notes.md' || '' }}
         id: goreleaser
       - name: Process goreleaser output
         if: env.SKIP_CONTAINER_PUBLISH == 'false'
@@ -114,9 +131,16 @@ jobs:
           const artifacts = ${{ steps.goreleaser.outputs.artifacts }};
           const firstNonNullDigest = artifacts.find(artifact => artifact.extra && artifact.extra.Digest != null)?.extra.Digest;
           console.log(firstNonNullDigest);
-          fs.writeFileSync('digest.txt', firstNonNullDigest);
+          if (firstNonNullDigest) {
+            fs.writeFileSync('digest.txt', firstNonNullDigest);
+          } else {
+            console.error('No digest found in artifacts');
+            process.exit(1);
+          }
           EOF
-          echo "digest=$(cat digest.txt)" >> "${GITHUB_OUTPUT}"
+          if [ -f digest.txt ]; then
+            echo "digest=$(cat digest.txt)" >> "${GITHUB_OUTPUT}"
+          fi
       - name: Attest Binaries
         if: ${{ (env.SKIP_CONTAINER_PUBLISH == 'false') && (inputs.is_pr_build == false) }}
         uses: actions/attest-build-provenance@v4.1.0
diff --git a/README.md b/README.md
index 8ace4ea..9e91d68 100644
--- a/README.md
+++ b/README.md
@@ -156,7 +156,9 @@ jobs:
 ```
 
 ### build-publish-container-goreleaser (Reusable Workflow)
-Builds and publishes a container image via GoReleaser, with multi-arch builds, build provenance attestation, and PR snapshot support.
+Builds and publishes a container image via GoReleaser, with multi-arch builds, build provenance attestation, and PR snapshot support. Release builds (`is_pr_build: false`) pass GitHub's auto-generated release notes for the pushed tag to GoReleaser via `--release-notes`.
+
+Optional `build_deps` is a space-separated list of apt packages installed before the build, for cases such as CGO cross-compilation that need a toolchain not present on the runner.
 
 **Usage:**
 ```yaml
@@ -166,6 +168,8 @@ jobs:
     with:
       registry_subject_name: ghcr.io/openchami/foo
       release_draft: false
+      cgo_enabled: 1
+      build_deps: gcc-aarch64-linux-gnu libc6-dev-arm64-cross
 ```
 
 ### build-rpm-quadlet (Reusable Workflow)