diff --git a/.gitattributes b/.gitattributes
index 9da70ba2fc..3dac3b0fe6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,10 @@
 *.sln.in eol=crlf
 *.vcxproj.* eol=crlf
+
+.gitignore			 export-ignore
+/conftools			 export-ignore
+/doc/design			 export-ignore
+/doc/dev			 export-ignore
+/util/**			 export-ignore
+/util/bindkeys.pl		-export-ignore
+/util/mksymtbl.pl		-export-ignore
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 654074c5b4..b8c1e1784a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -21,6 +21,9 @@ variables:
 
   CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 
 
+  TARBALL_COMPRESSOR: xz
+  TARBALL_EXTENSION: xz
+
 stages:
   - precheck
   - build
@@ -29,6 +32,7 @@ stages:
   - docs
   - push
   - postcheck
+  - release
 
 ### Runner Tag Templates
 
@@ -194,6 +198,36 @@ stages:
     untracked: true
     expire_in: "1 week"
 
+.windows_build: &windows_build_job
+  stage: build
+  tags:
+    - windows
+    - amd64
+  script:
+    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
+    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
+    - 'Pop-Location'
+    - 'Set-Location win32utils'
+    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
+         "with-tools-version=15.0"
+         "with-platform-toolset=v141"
+         "with-platform-version=10.0.17763.0"
+         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
+         "with-openssl=C:/OpenSSL"
+         "with-libxml2=C:/libxml2"
+         "with-libuv=C:/libuv"
+         "without-python"
+         "with-system-tests"
+         x64'
+    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
+    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
+  dependencies: []
+  needs:
+    - autoreconf:sid:amd64
+  artifacts:
+    untracked: true
+    expire_in: "1 week"
+
 .setup_interfaces: &setup_interfaces |
     if [ "$(id -u)" -eq "0" ]; then
       sh -x bin/tests/system/ifconfig.sh up;
@@ -202,7 +236,7 @@ stages:
     fi
 
 .setup_softhsm: &setup_softhsm |
-    sh -x util/prepare-softhsm2.sh
+    sh -x bin/tests/prepare-softhsm2.sh
 
 .system_test: &system_test_job
   <<: *default_triggering_rules
@@ -225,6 +259,30 @@ stages:
        --results-filter "" \
        --output kyua_html
 
+.windows_system_test: &windows_system_test_job
+  stage: system
+  tags:
+    - windows
+    - amd64
+  script:
+    - 'Push-Location bin/tests/system'
+    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
+    - '& cmd.exe /C ifconfig.bat up; ""'
+    - 'Start-Sleep 2'
+    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
+    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
+    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
+  artifacts:
+    untracked: true
+    expire_in: "1 week"
+    when: on_failure
+  only:
+    - schedules
+    - tags
+    - web
+
 .unit_test: &unit_test_job
   <<: *default_triggering_rules
   stage: unit
@@ -318,6 +376,23 @@ misc:sid:amd64:
     - util/check-cocci
     - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
 
+tarball-create:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  script:
+    - source version
+    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
+    - git archive --prefix="${BIND_DIRECTORY}/" --output="${BIND_DIRECTORY}.tar" HEAD
+    - mkdir "${BIND_DIRECTORY}"
+    - echo "SRCID=$(git rev-list --max-count=1 HEAD | cut -b1-7)" > "${BIND_DIRECTORY}/srcid"
+    - tar --append --file="${BIND_DIRECTORY}.tar" "${BIND_DIRECTORY}/srcid"
+    - ${TARBALL_COMPRESSOR} "${BIND_DIRECTORY}.tar"
+  artifacts:
+    paths:
+      - bind-*.tar.${TARBALL_EXTENSION}
+  only:
+    - tags
+
 # Jobs for doc builds on Debian Sid (amd64)
 
 docs:sid:amd64:
@@ -578,6 +653,48 @@ cppcheck:gcc:sid:amd64:
     - gcc:sid:amd64
   needs: ["gcc:sid:amd64"]
 
+# Jobs for tarball GCC builds on Debian Sid (amd64)
+
+tarball:sid:amd64:
+  variables:
+    CC: gcc
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+    RUN_MAKE_INSTALL: 1
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+  before_script:
+    - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
+    - rm -f bind-*.tar.${TARBALL_EXTENSION}
+    - cd bind-*
+  dependencies:
+    - tarball-create:sid:amd64
+  needs: ["tarball-create:sid:amd64"]
+  only:
+    - tags
+
+system:tarball:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  before_script:
+    - cd bind-*
+    - *setup_interfaces
+  dependencies:
+    - tarball:sid:amd64
+  needs: ["tarball:sid:amd64"]
+  only:
+    - tags
+
+unit:tarball:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  before_script:
+    - cd bind-*
+  dependencies:
+    - tarball:sid:amd64
+  needs: ["tarball:sid:amd64"]
+  only:
+    - tags
+
 # Jobs for regular GCC builds on Debian Sid (i386)
 
 gcc:sid:i386:
@@ -887,63 +1004,74 @@ unit:nolibtool:sid:amd64:
 # Jobs for Visual Studio 2017 builds on Windows (amd64)
 
 msvc:windows:amd64:
+  <<: *windows_build_job
   <<: *default_triggering_rules
-  stage: build
-  tags:
-    - windows
-    - amd64
   variables:
     VSCONF: Release
-  script:
-    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
-    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
-    - 'Pop-Location'
-    - 'Set-Location win32utils'
-    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
-         "with-tools-version=15.0"
-         "with-platform-toolset=v141"
-         "with-platform-version=10.0.17763.0"
-         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
-         "with-openssl=C:/OpenSSL"
-         "with-libxml2=C:/libxml2"
-         "with-libuv=C:/libuv"
-         "without-python"
-         "with-system-tests"
-         x64'
-    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
-    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
-  dependencies: []
-  needs:
-    - autoreconf:sid:amd64
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
 
 system:msvc:windows:amd64:
-  stage: system
-  tags:
-    - windows
-    - amd64
+  <<: *windows_system_test_job
   variables:
     VSCONF: Release
-  script:
-    - 'Push-Location bin/tests/system'
-    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
-    - '& cmd.exe /C ifconfig.bat up; ""'
-    - 'Start-Sleep 2'
-    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
-    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
-    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
   dependencies:
     - msvc:windows:amd64
   needs: ["msvc:windows:amd64"]
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
-    when: on_failure
+
+msvc-debug:windows:amd64:
+  <<: *windows_build_job
+  variables:
+    VSCONF: Debug
   only:
     - schedules
     - tags
     - web
+
+system:msvc-debug:windows:amd64:
+  <<: *windows_system_test_job
+  variables:
+    VSCONF: Debug
+  dependencies:
+    - msvc-debug:windows:amd64
+  needs: ["msvc-debug:windows:amd64"]
+
+# Job producing a release tarball
+
+release:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: release
+  script:
+    # Determine BIND version
+    - source version
+    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
+    # Remove redundant files and system test utilities from Windows build artifacts
+    - find Build/Release/ -name "*.pdb" -print -delete
+    - find Build/Debug/ \( -name "*.bsc" -o -name "*.idb" \) -print -delete
+    - find Build/ -regextype posix-extended -regex "Build/.*/($(find bin/tests/ -type f | sed -nE "s|^bin/tests(/system)?/win32/(.*)\.vcxproj$|\2|p" | paste -d"|" -s))\..*" -print -delete
+    # Create Windows zips
+    - openssl dgst -sha256 "${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" | tee Build/Release/SHA256 Build/Debug/SHA256
+    - ( cd Build/Release; zip "../../BIND${BIND_DIRECTORY#bind-}.x64.zip" * )
+    - ( cd Build/Debug; zip "../../BIND${BIND_DIRECTORY#bind-}.debug.x64.zip" * )
+    # Prepare release tarball contents (tarballs + zips + documentation)
+    - mkdir -p release/doc/arm
+    - pushd release
+    - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" ../BIND*.zip .
+    - tar --extract --file="${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}"
+    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README,srcid} .
+    - mv "${BIND_DIRECTORY}"/doc/arm/{Bv9ARM{*.html,.pdf},man.*,notes.{html,pdf,txt}} doc/arm/
+    - rm -rf "${BIND_DIRECTORY}"
+    - cp doc/arm/notes.html "RELEASE-NOTES-${BIND_DIRECTORY}.html"
+    - cp doc/arm/notes.pdf "RELEASE-NOTES-${BIND_DIRECTORY}.pdf"
+    - cp doc/arm/notes.txt "RELEASE-NOTES-${BIND_DIRECTORY}.txt"
+    - popd
+    # Create release tarball
+    - tar --create --file="${CI_COMMIT_TAG}.tar.gz" --gzip release/
+  dependencies:
+    - tarball-create:sid:amd64
+    - msvc:windows:amd64
+    - msvc-debug:windows:amd64
+  only:
+    - tags
+  artifacts:
+    paths:
+      - "*.tar.gz"
+    expire_in: "1 week"
diff --git a/.gitlab/issue_templates/Release.md b/.gitlab/issue_templates/Release.md
index 5ee3a6c01a..3bac8a2a0c 100644
--- a/.gitlab/issue_templates/Release.md
+++ b/.gitlab/issue_templates/Release.md
@@ -33,8 +33,7 @@
 
 ## Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
 
- - [ ] ***(QA)*** Run the `make release` Jenkins jobs to produce the tarballs and zips.
- - [ ] ***(QA)*** Verify the results of `make release` Jenkins jobs and prepare a QA report for the releases to be published.
+ - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
  - [ ] ***(QA)*** Request signatures for the tarballs.
  - [ ] ***(Signers)*** Sign the tarballs.
  - [ ] ***(QA)*** Check tarball signatures.
diff --git a/util/prepare-softhsm2.sh b/bin/tests/prepare-softhsm2.sh
old mode 100644
new mode 100755
similarity index 100%
rename from util/prepare-softhsm2.sh
rename to bin/tests/prepare-softhsm2.sh
diff --git a/bin/tests/system/runtime/tests.sh b/bin/tests/system/runtime/tests.sh
index e43e96e0ba..e35cb70267 100644
--- a/bin/tests/system/runtime/tests.sh
+++ b/bin/tests/system/runtime/tests.sh
@@ -204,7 +204,7 @@ if [ "$(id -u)" -eq 0 ] && [ -z "$CYGWIN" ]; then
     if [ "$?" -eq 0 ]; then
         copy_setports ns2/named-alt9.conf.in "${TEMP_NAMED_DIR}/named-alt9.conf"
         export SOFTHSM2_CONF="${TEMP_NAMED_DIR}/softhsm2.conf"
-        sh "$TOP/util/prepare-softhsm2.sh"
+        sh "$TOP/bin/tests/prepare-softhsm2.sh"
         chown -R nobody: "${TEMP_NAMED_DIR}"
         chmod 0700 "${TEMP_NAMED_DIR}"
         ( cd "${TEMP_NAMED_DIR}" && $NAMED -u nobody -c named-alt9.conf -d 99 -g -U 4 >> named$n.run 2>&1 & ) || ret=1
diff --git a/util/copyrights b/util/copyrights
index a14a28c124..d8e7538431 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -349,6 +349,7 @@
 ./bin/tests/pkcs11/benchmarks/sha1.c		C	2014,2015,2016,2018,2019
 ./bin/tests/pkcs11/benchmarks/sign.c		C	2014,2015,2016,2018,2019
 ./bin/tests/pkcs11/benchmarks/verify.c		C	2014,2015,2016,2018,2019
+./bin/tests/prepare-softhsm2.sh			X	2018,2019
 ./bin/tests/startperf/README			X	2011,2018,2019
 ./bin/tests/startperf/clean.sh			SH	2011,2012,2016,2018,2019
 ./bin/tests/startperf/makenames.pl		PERL	2011,2012,2016,2018,2019
@@ -2592,7 +2593,6 @@
 ./util/nanny.pl					PERL	2000,2001,2004,2007,2012,2016,2018,2019
 ./util/new-func					PERL	2005,2007,2012,2016,2018,2019
 ./util/nt-kit					SH	1999,2000,2001,2004,2007,2012,2016,2018,2019
-./util/prepare-softhsm2.sh			X	2018,2019
 ./util/spacewhack.pl				PERL	2000,2001,2004,2007,2012,2016,2018,2019
 ./util/tabify-changes				SH	2004,2007,2012,2016,2018,2019
 ./util/update-drafts.pl				PERL	2000,2001,2004,2007,2012,2016,2018,2019