diff --git a/.github/workflows/build-pkg.yml b/.github/workflows/build-pkg.yml
new file mode 100644
index 0000000000..ddbcdbc22d
--- /dev/null
+++ b/.github/workflows/build-pkg.yml
@@ -0,0 +1,40 @@
+name: Build Homebrew package
+on:
+  push:
+    paths:
+      - .github/workflows/build-pkg.yml
+      - package/scripts
+  release:
+    types:
+      - published
+
+jobs:
+  build:
+    runs-on: macos-12
+    env:
+      IDENTIFIER: sh.brew.Homebrew
+      TMP_PATH: /tmp/brew
+      MIN_OS: '11.0'
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          path: brew
+          fetch-depth: 0
+      - name: Version name
+        id: print-version
+        run: |
+          echo "version=$(git -C brew describe --tags --always)" > $GITHUB_OUTPUT
+      - name: Build package
+        run: |
+         pkgbuild --root brew \
+                  --scripts brew/package/scripts \
+                  --install-location "$TMP_PATH" \
+                  --identifier "$IDENTIFIER" \
+                  --min-os-version "$MIN_OS" \
+                  --filter .DS_Store \
+                  --version ${{ steps.print-version.outputs.version }} \
+                  Homebrew-${{ steps.print-version.outputs.version }}.pkg
+      - uses: actions/upload-artifact@v3
+        with:
+          name: Homebrew ${{ steps.print-version.outputs.version }}
+          path: Homebrew-${{ steps.print-version.outputs.version }}.pkg
diff --git a/.gitignore b/.gitignore
index 7e5b4819fc..bedc02b47f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -179,6 +179,9 @@
 !/docs
 !/manpages
 
+# Unignore our packaging files
+!/package
+
 # Ignore generated documentation site
 /docs/_site
 /docs/bin
diff --git a/Library/Homebrew/style.rb b/Library/Homebrew/style.rb
index 6beacb720b..544249a26b 100644
--- a/Library/Homebrew/style.rb
+++ b/Library/Homebrew/style.rb
@@ -263,6 +263,7 @@ module Homebrew
         HOMEBREW_REPOSITORY/"completions/bash/brew",
         HOMEBREW_REPOSITORY/"Dockerfile",
         *HOMEBREW_REPOSITORY.glob(".devcontainer/**/*.sh"),
+        *HOMEBREW_REPOSITORY.glob("package/scripts/*"),
         *HOMEBREW_LIBRARY.glob("Homebrew/**/*.sh").reject { |path| path.to_s.include?("/vendor/") },
         *HOMEBREW_LIBRARY.glob("Homebrew/shims/**/*").map(&:realpath).uniq
                          .reject(&:directory?)
diff --git a/package/scripts/postinstall b/package/scripts/postinstall
new file mode 100755
index 0000000000..7ea0389bb5
--- /dev/null
+++ b/package/scripts/postinstall
@@ -0,0 +1,54 @@
+#!/bin/bash
+# $1 Full path to the installer - unused
+# $2 Location of the temporary brew install we're moving into place
+# $3 Target install location - unused
+# $4 System root directory - unused
+set -e
+
+# verify the files exist
+tmp_brew="$2"
+if [[ ! -d "${tmp_brew:?}" ]]
+then
+  echo "no directory at ${tmp_brew}, exiting"
+  exit 1
+fi
+
+# pick the correct target
+if [[ $(uname -m) == "x86_64" ]]
+then
+  target="/usr/local"
+else
+  target="/opt/Homebrew"
+fi
+
+loggedInUser=$(echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ { print $3 }')
+if [[ -f "${target}/bin/brew" ]]
+then
+  if [[ $(sudo -u"${loggedInUser}" git -C "${target}" branch --show-current) != "master" ]]
+  then
+    echo "working on brew modifications, exiting"
+    rm -rf "${tmp_brew:?}/*"
+    exit 0
+  fi
+  if [[ $("${tmp_brew}/bin/brew" --version | head -n1) != $("${target}/bin/brew" --version | head -n1) ]]
+  then
+    echo "already an outdated install at ${target}, updating"
+    sudo -u"${loggedInUser}" "${target}/bin/brew" update --auto-update
+  else
+    echo "already an up-to-date install at ${target}, exiting"
+  fi
+
+  rm -rf "${tmp_brew:?}/*"
+  exit 0
+fi
+
+group=$(id -gn "${loggedInUser}")
+
+install -d -o "${loggedInUser}" -g "${group}" "${target}"
+cp -RX "${tmp_brew}/" "${target}"
+
+# set permissions
+chown -R "${loggedInUser}:${group}" "${target}/*"
+
+# cleanup
+rm -rf "${tmp_brew:?}/*"
diff --git a/package/scripts/preinstall b/package/scripts/preinstall
new file mode 100755
index 0000000000..49afc85251
--- /dev/null
+++ b/package/scripts/preinstall
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# Checked for installed CLT
+if [[ -e "/Library/Developer/CommandLineTools/usr/bin/git" ]]
+then
+  exit 0
+fi
+
+CLT_PLACEHOLDER="/tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress"
+touch "${CLT_PLACEHOLDER}"
+
+CLT_PACKAGE=$(softwareupdate -l |
+  grep -B 1 "Command Line Tools" |
+  awk -F"*" '/^ *\*/ {print $2}' |
+  sed -e 's/^ *Label: //' -e 's/^ *//' |
+  sort -V |
+  tail -n1)
+softwareupdate -i "${CLT_PACKAGE}"
+rm -f "${CLT_PLACEHOLDER}"
+if ! [[ -f "/Library/Developer/CommandLineTools/usr/bin/git" ]]
+then
+  if [[ -z "${COMMAND_LINE_INSTALL}" ]]
+  then
+    echo
+    printf "Requesting user install of Xcode Command Line Tools:"
+    /usr/bin/xcode-select --install
+  else
+    echo
+    printf "Run 'xcode-select --install' to install the Xcode Command Line Tools before running a headless brew install."
+    exit 1
+  fi
+fi