diff --git a/.ci/publish_release_artifact.sh b/.ci/publish_release_artifact.sh
new file mode 100755
index 000000000..365734144
--- /dev/null
+++ b/.ci/publish_release_artifact.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -e
+set -o pipefail
+
+if [[ -z $GITHUB_TOKEN ]]; then
+	echo "No GITHUB_TOKEN secret found, artifact publishing skipped"
+	exit
+fi
+
+mkdir -p $HOME/.local/bin
+export _GHR_VER=v0.13.0
+export _GHR=ghr_${_GHR_VER}_linux_amd64
+curl -sfL https://github.com/tcnksm/ghr/releases/download/$_GHR_VER/$_GHR.tar.gz |
+	tar xz -C $HOME/.local/bin --strip-components=1 $_GHR/ghr
+
+ghr -replace \
+	-u $CIRCLE_PROJECT_USERNAME \
+	-r $CIRCLE_PROJECT_REPONAME \
+	$CIRCLE_TAG \
+	$1
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1835c63a8..ecc645fae 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -75,17 +75,11 @@ jobs:
   publish-dist:
     executor: autotools-executor
     steps:
+      - checkout
       - attach_workspace:
           at: .
       - run: |
-          if [[ -n $GITHUB_TOKEN ]]; then
-            export _GHR=ghr_v0.13.0_linux_amd64
-            curl -sL https://github.com/tcnksm/ghr/releases/download/v0.13.0/$_GHR.tar.gz | tar xz --strip-components=1 $_GHR/ghr
-            echo TOKEN IS = $GITHUB_TOKEN
-            ./ghr -replace -u $CIRCLE_PROJECT_USERNAME -r $CIRCLE_PROJECT_REPONAME $CIRCLE_TAG harfbuzz-$CIRCLE_TAG.tar.xz
-          else
-            echo "No GITHUB_TOKEN secret found, artifact publishing skipped"
-          fi
+          .ci/publish_release_artifact.sh harfbuzz-$CIRCLE_TAG.tar.xz
 
   fedora-valgrind:
     docker:
@@ -164,18 +158,12 @@ jobs:
   publish-win32:
     executor: win32-executor
     steps:
+      - checkout
       - attach_workspace:
           at: .
       - run: |
-          if [[ -n $GITHUB_TOKEN ]]; then
-            export _GHR=ghr_v0.13.0_linux_amd64
-            curl -sL https://github.com/tcnksm/ghr/releases/download/v0.13.0/$_GHR.tar.gz | tar xz --strip-components=1 $_GHR/ghr
-            mv harfbuzz-win32{,-$CIRCLE_TAG}.zip
-            echo TOKEN IS = $GITHUB_TOKEN
-            ./ghr -replace -u $CIRCLE_PROJECT_USERNAME -r $CIRCLE_PROJECT_REPONAME $CIRCLE_TAG harfbuzz-win32-$CIRCLE_TAG.zip
-          else
-            echo "No GITHUB_TOKEN secret found, artifact publishing skipped"
-          fi
+          mv harfbuzz-win32{,-$CIRCLE_TAG}.zip
+          .ci/publish_release_artifact.sh harfbuzz-win32-$CIRCLE_TAG.zip
 
 workflows:
   version: 2