diff --git a/.github/workflows/build-binary.yml b/.github/workflows/build-binary.yml
new file mode 100644
index 0000000..3d5366c
--- /dev/null
+++ b/.github/workflows/build-binary.yml
@@ -0,0 +1,122 @@
+name: Build java app image
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      sem-version:
+        description: 'Version'
+        required: false
+
+env:
+  JAVA_DIST: 'zulu'
+  JAVA_VERSION: '22.0.2+9'
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  prepare:
+    name: Determines the versions strings for the binaries
+    runs-on: [ubuntu-latest]
+    outputs:
+      semVerStr: ${{ steps.determine-version.outputs.version }}
+      semVerNum: ${{steps.determine-number.outputs.number}}
+    steps:
+      - id: determine-version
+        shell: pwsh
+        run: |
+          if ( ${{github.event_name}} -eq 'release') {
+            echo "version=${{ github.event.release.tag_name}}" >> $GITHUB_OUTPUT
+          } else if (${{inputs.sem-version}}) {
+             echo "version=${{ inputs.sem-version}}" >> $GITHUB_OUTPUT
+          }
+          Write-Error "Version neither via input nor by tag specified. Aborting"
+          exit 1
+      - id: determine-number
+        run: |
+          SEM_VER_NUM=`echo ${{ steps.determine-version.outputs.version }} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
+          echo "number=${SEM_VER_NUM}" >> $GITHUB_OUTPUT
+
+  build-win:
+    name: Build java app image on windows
+    needs: [prepare]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            architecture: x64
+            native-access-lib: 'org.cryptomator.jfuse.linux.amd64'
+          - os: [self-hosted, Linux, ARM64]
+            architecture: aarch64
+            native-access-lib: 'org.cryptomator.jfuse.linux.aarch64'
+          - os: [self-hosted, macOS, ARM64]
+            architecture: aarch64
+            native-access-lib: 'org.cryptomator.jfuse.mac'
+          - os: macos-latest
+            architecture: x64
+            native-access-lib: 'org.cryptomator.jfuse.mac'
+          - os: windows-latest
+            architecture: x64
+            native-access-lib: 'org.cryptomator.jfuse.win'
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: prepare windows
+        if: startsWith(matrix.os, 'windows')
+        run: echo "JPACKAGE_OS_OPTS=--win-console" >> "$GITHUB_ENV"
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          java-version: '22'
+          distribution: 'temurin'
+      - name: Set version
+        run: mvn versions:set -DnewVersion=${{ needs.prepare.outputs.semVerStr }}
+      - name: Run maven
+        run: mvn -B clean package -Pwin -DskipTests
+      - name: Patch target dir
+        run: |
+          cp LICENSE.txt target
+          cp target/cryptomator-*.jar target/mods
+      - name: Run jlink
+        shell: pwsh
+        run: >
+          & $env:JAVA_HOME\bin\jlink
+          --verbose
+          --output target\runtime
+          --module-path "${env:JAVA_HOME}\jmods"
+          --add-modules java.base,java.compiler,java.naming,java.xml `
+          --strip-native-commands `
+          --no-header-files `
+          --no-man-pages `
+          --strip-debug `
+          --compress zip-6
+      - name: Run jpackage
+        shell: pwsh
+        #TODO: app version
+        run: >
+          & $env:JAVA_HOME\bin\jpackage
+          --verbose
+          --type app-image
+          --runtime-image target/runtime
+          --input target/libs
+          --module-path target/mods
+          --module org.cryptomator.cli/org.cryptomator.cli.CryptomatorCli
+          --dest target
+          --name cryptomator-cli
+          --vendor "Skymatic GmbH"
+          --copyright "(C) 2016 - 2024 Skymatic GmbH"
+          --app-version "${{ needs.prepare.outputs.semVerNum }}"
+          --java-options "--enable-preview"
+          --java-options "--enable-native-access=${{ matrix.native-access-lib }}"
+          --java-options "-Xss5m"
+          --java-options "-Xmx256m"
+          --java-options '-Dfile.encoding="utf-8"'
+          ${JPACKAGE_OS_OPTS}
+      - uses: upload-artifact@v4
+        with:
+          path: .\target\cryptomator-cli
+          if-no-files-found: error
+
diff --git a/README.md b/README.md
index cff7a1f..ab5a757 100644
--- a/README.md
+++ b/README.md
@@ -7,28 +7,49 @@ This is a minimal command-line application that unlocks a single vault of vault
 
 ## Download and Usage
 
-Download the JAR file via [GitHub Releases](https://github.com/cryptomator/cli/releases).
+Download the zip file via [GitHub Releases](https://github.com/cryptomator/cli/releases) and unzip it to your desired directory, e.g.
 
-Cryptomator CLI requires that at least JDK/JRE 22 is present on your system.
 ```sh
-java --enable-native-access="ALL-UNNAMED" -jar cryptomator-cli-x.y.z.jar \
-    --password:stdin \
-    --mounter=org.cryptomator.frontend.fuse.mount.FuseMountProvider \
-    --mountPoint=/home/user/existing/empty/dir \
-    /path/to/vault
-# Be aware that passing the password on the command-line typically makes it visible to anyone on your system!
+curl -L https://github.com/cryptomator/cli/releases/download/0.7.0/cryptomator-cli-0.7.0-mac-arm64.dmg --output cryptomator-cli.zip
+unzip cryptomator-cli.zip
 ```
 
-For a complete list of options, start the jar with the `--help` argument.
+Afterwards, you can directly run Cryptomator-CLI:
+```sh
+cryptomator-cli unlock \
+--password:stdin \
+--mounter=org.cryptomator.frontend.fuse.mount.LinuxFuseMountProvider \
+--mountPoint=/path/to/empty/dir \
+/home/user/myVault
+```
+
+For a complete list of options, use the`--help` option.
 ```shell
-java --enable-native-access="ALL-UNNAMED" -jar cryptomator-cli-x.y.z.jar --help
+cryptomator-cli unlock --help`
 ```
 
-## Block Filesystem Integration 
+## FileSystem Integration
+
+For an OS integration of your unlocked vault, cryptomator-cli relies on third party libraries which must be installed seperately.
+These are:
+* [WinFsp](https://winfsp.dev/) for Windows
+* [macFUSE](https://osxfuse.github.io/) or [FUSE-T](https://www.fuse-t.org/) for macOS
+* and [libfuse](https://github.com/libfuse/libfuse) for Linux/BSD systems (normally provided by a fuse3 package of your distro, e.g. [ubuntu](https://packages.ubuntu.com/noble/fuse3))
+
+As a fallback, you can [skip filesystem integration](README.md#skip-filesystem-integration).
+
+## Selecting the Mounter
+
+TODO
+
+## Skip Filesystem Integration 
+
+If you don't want a direct integration in the OS, choose `org.cryptomator.frontend.webdav.mount.FallbackMounter` for `--mounter`.
+It starts a local WebDAV server, where you can access the vault with any WebDAV client or mounting it into your filesystem manually.
 
-Depending on the chosen mounter, the vault is automatically integrated into the os.
-If you don't want a direct integration, choose `org.cryptomator.frontend.webdav.mount.FallbackMounter` for `--mounter`.
-It starts a local WebDAV server started, where you can access the vault by any WebDAV client or mounting it into your filesystem manually.
+> [!NOTE]
+> The WebDAV protocol is supported by all major OSses. Hence, if other mounters fail or show errors when accessing the vault content, you can always use the legacy WebDAV option.
+> WebDAV is not the default, because it has a low performance and might have OS dependent restrictions (e.g. maximum file size of 4GB on Windows)
 
 ### Windows via Windows Explorer
 
diff --git a/build.ps1 b/build.ps1
new file mode 100644
index 0000000..3cd46ba
--- /dev/null
+++ b/build.ps1
@@ -0,0 +1,52 @@
+"Building cryptomator cli..."
+
+$commands = 'mvn'
+$envVars = 'JAVA_HOME'
+foreach ($cmd in $commands) {
+    Invoke-Expression -Command "${cmd} --version" -ErrorAction Stop
+}
+
+(Get-ChildItem env:* | Where-Object { $envVars -contains $_.Name} | Measure-Object).Count
+
+<#
+foreach ($envVar in $envVars) {
+    if( "$env:$envVar")
+}
+#>
+
+mvn -B clean package
+Copy-Item .\LICENSE.txt -Destination .\target
+Move-Item .\target\cryptomator-cli-*.jar .\target\mods
+## according to jdpes we only need java.base (and java.compiler due to dagger)
+& $env:JAVA_HOME\bin\jlink `
+--verbose `
+--output target\runtime `
+--module-path "${env:JAVA_HOME}\jmods" `
+--add-modules java.base,java.compiler,java.naming,java.xml `
+--strip-native-commands `
+--no-header-files `
+--no-man-pages `
+--strip-debug `
+--compress zip-0
+
+# jpackage
+& $env:JAVA_HOME\bin\jpackage `
+    --verbose `
+    --type app-image `
+    --runtime-image target/runtime `
+    --input target/libs `
+    --module-path target/mods `
+    --module org.cryptomator.cli/org.cryptomator.cli.CryptomatorCli `
+    --dest target `
+    --name cryptomator-cli `
+    --vendor "Skymatic GmbH" `
+    --copyright "(C) 2016 - 2024 Skymatic GmbH" `
+    --app-version "1.0.0.0" `
+    --java-options "--enable-preview" `
+    --java-options "--enable-native-access=org.cryptomator.jfuse.win" `
+    --java-options "-Xss5m" `
+    --java-options "-Xmx256m" `
+    --java-options '-Dfile.encoding="utf-8"' `
+    --win-console
+    #--resource-dir dist/win/resources
+    #--icon dist/win/resources/Cryptomator.ico
diff --git a/pom.xml b/pom.xml
index 47bdc7a..2231b1f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -12,6 +12,12 @@
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<jdk.version>22</jdk.version>
 
+		<!--jpackage stuff -->
+		<!-- Group IDs of jars that need to stay on the class path for now
+		 remove them, as soon they got modularized or support is dropped (i.e., WebDAV) -->
+		<nonModularGroupIds>org.ow2.asm,org.apache.jackrabbit,org.apache.httpcomponents</nonModularGroupIds>
+
+
 		<!-- native image options -->
 		<mainClass>org.cryptomator.cli.CryptomatorCli</mainClass>
 		<native.optimization>-Ob</native.optimization> <!-- default: no optimization/dev build-->
@@ -106,6 +112,7 @@
 	</dependencies>
 
 	<build>
+		<finalName>cryptomator-cli-${project.version}</finalName>
 		<plugins>
 			<plugin>
 				<artifactId>maven-compiler-plugin</artifactId>
@@ -138,63 +145,84 @@
 					</archive>
 				</configuration>
 			</plugin>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-shade-plugin</artifactId>
-				<version>${maven-shade.version}</version>
+				<plugin>
+					<groupId>org.codehaus.mojo</groupId>
+					<artifactId>exec-maven-plugin</artifactId>
+					<version>${maven-exec.version}</version>
+					<executions>
+						<execution>
+							<id>test-run</id>
+							<goals>
+								<goal>exec</goal>
+							</goals>
+						</execution>
+					</executions>
+					<configuration>
+						<executable>${env.JAVA_HOME}/bin/java</executable>
+						<arguments>
+							<argument>--module-path</argument>
+							<modulepath/>
+							<argument>--enable-native-access=org.cryptomator.jfuse.linux,org.cryptomator.jfuse.win,org.cryptomator.jfuse.mac</argument>
+							<argument>--module</argument>
+							<argument>org.cryptomator.cli/${mainClass}</argument>
+							<argument>--password:stdin</argument>
+							<argument>--mounter=org.cryptomator.frontend.fuse.mount.WinFspNetworkMountProvider</argument>
+							<argument>--mountPoint=X:\\</argument>
+							<argument>T:\\vaultFormat8</argument>
+						</arguments>
+					</configuration>
+				</plugin>
+					<plugin>
+						<groupId>org.apache.maven.plugins</groupId>
+						<artifactId>maven-dependency-plugin</artifactId>
+						<executions>
+							<!-- sort jars into two buckets (classpath and modulepath). exclude openjfx, which gets jlinked separately -->
+							<execution>
+								<id>copy-mods</id>
+								<phase>prepare-package</phase>
+								<goals>
+									<goal>copy-dependencies</goal>
+								</goals>
+								<configuration>
+									<includeScope>runtime</includeScope>
+									<outputDirectory>${project.build.directory}/mods</outputDirectory>
+									<excludeGroupIds>${nonModularGroupIds}</excludeGroupIds>
+								</configuration>
+							</execution>
+							<execution>
+								<id>copy-libs</id>
+								<phase>prepare-package</phase>
+								<goals>
+									<goal>copy-dependencies</goal>
+								</goals>
+								<configuration>
+									<includeScope>runtime</includeScope>
+									<outputDirectory>${project.build.directory}/libs</outputDirectory>
+									<includeGroupIds>${nonModularGroupIds}</includeGroupIds>
+								</configuration>
+							</execution>
+						</executions>
+					</plugin>
+			<!--plugin>
+				<groupId>org.codehaus.mojo</groupId>
+				<artifactId>license-maven-plugin</artifactId>
 				<executions>
 					<execution>
+						<id>add-third-party</id>
 						<goals>
-							<goal>shade</goal>
+							<goal>add-third-party</goal>
 						</goals>
+						<phase>generate-resources</phase>
 						<configuration>
-							<shadedArtifactAttached>true</shadedArtifactAttached>
-							<finalName>cryptomator-cli-${project.version}</finalName>
-							<transformers>
-								<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
-									<mainClass>${mainClass}</mainClass>
-								</transformer>
-								<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
-									<resource>META-INF/services/org.cryptomator.integrations.mount.MountService</resource>
-								</transformer>
-								<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
-									<resource>META-INF/services/org.cryptomator.jfuse.api.FuseBuilder</resource>
-								</transformer>
-								<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
-									<resource>META-INF/services/ch.qos.logback.classic.spi.Configurator</resource>
-								</transformer>
-							</transformers>
+							<thirdPartyFilename>THIRD-PARTY.txt</thirdPartyFilename>
+							<includedScopes>compile</includedScopes>
+							<excludedGroups>org\.cryptomator</excludedGroups>
+							<licenseMergesUrl>file:///${project.basedir}/license/merges</licenseMergesUrl>
+							<fileTemplate>${project.basedir}/src/main/resources/license/template.ftl</fileTemplate>
 						</configuration>
 					</execution>
 				</executions>
-			</plugin>
-			<plugin>
-				<groupId>org.codehaus.mojo</groupId>
-				<artifactId>exec-maven-plugin</artifactId>
-				<version>${maven-exec.version}</version>
-				<executions>
-					<execution>
-						<id>test-run</id>
-						<goals>
-							<goal>exec</goal>
-						</goals>
-					</execution>
-				</executions>
-				<configuration>
-					<executable>${env.JAVA_HOME}/bin/java</executable>
-					<arguments>
-						<argument>--module-path</argument>
-						<modulepath/>
-						<argument>--enable-native-access=org.cryptomator.jfuse.linux,org.cryptomator.jfuse.win,org.cryptomator.jfuse.mac</argument>
-						<argument>--module</argument>
-						<argument>org.cryptomator.cli/${mainClass}</argument>
-						<argument>--password:stdin</argument>
-						<argument>--mounter=org.cryptomator.frontend.fuse.mount.WinFspNetworkMountProvider</argument>
-						<argument>--mountPoint=X:\\</argument>
-						<argument>T:\\vaultFormat8</argument>
-					</arguments>
-				</configuration>
-			</plugin>
+			</plugin-->
 		</plugins>
 	</build>
 </project>