diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml
index fa1d2ac1..6b3426ab 100644
--- a/.github/workflows/release-binaries.yaml
+++ b/.github/workflows/release-binaries.yaml
@@ -48,18 +48,49 @@ jobs:
           fi
           echo "Building version ${VERSION}"
           mkdir -p dist
-          for bin in abctl authbridge-proxy; do
-            for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
-              os="${target%/*}"
-              arch="${target#*/}"
-              echo "==> ${bin} ${os}/${arch}"
-              ( cd "authbridge/cmd/${bin}" && \
-                GOWORK=off CGO_ENABLED=0 GOOS="${os}" GOARCH="${arch}" \
-                go build -trimpath \
-                  -ldflags "-s -w -X main.version=${VERSION}" \
-                  -o "${GITHUB_WORKSPACE}/dist/${bin}" . )
-              tar -C dist -czf "dist/${bin}_${VERSION}_${os}_${arch}.tar.gz" "${bin}"
-              rm -f "dist/${bin}"
+
+          # authbridge-proxy variants: "<suffix>:<build-tags>". Empty
+          # suffix is the default plugin set. One variant per opt-in
+          # plugin (or one combined "full") — never enumerate combos.
+          lite_tags="exclude_plugin_a2aparser,exclude_plugin_ibac"
+          lite_tags="${lite_tags},exclude_plugin_inferenceparser"
+          lite_tags="${lite_tags},exclude_plugin_mcpparser,exclude_plugin_opa"
+          lite_tags="${lite_tags},exclude_plugin_sparc,exclude_plugin_tokenbroker"
+          declare -a proxy_variants=(
+            ":"
+            "lite:${lite_tags}"
+            "sessionbudget:include_plugin_sessionbudget"
+          )
+
+          build_proxy() {
+            local variant="$1" tags="$2" os="$3" arch="$4"
+            local suffix=""; [ -n "${variant}" ] && suffix="-${variant}"
+            local archive="dist/authbridge-proxy${suffix}_${VERSION}_${os}_${arch}.tar.gz"
+            echo "==> authbridge-proxy${suffix} ${os}/${arch}"
+            ( cd authbridge/cmd/authbridge-proxy && \
+              GOWORK=off CGO_ENABLED=0 GOOS="${os}" GOARCH="${arch}" \
+              go build -trimpath \
+                -tags "${tags}" \
+                -ldflags "-s -w -X main.version=${VERSION}" \
+                -o "${GITHUB_WORKSPACE}/dist/authbridge-proxy" . )
+            tar -C dist -czf "${archive}" authbridge-proxy
+            rm -f dist/authbridge-proxy
+          }
+
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
+            os="${target%/*}"; arch="${target#*/}"
+
+            echo "==> abctl ${os}/${arch}"
+            ( cd authbridge/cmd/abctl && \
+              GOWORK=off CGO_ENABLED=0 GOOS="${os}" GOARCH="${arch}" \
+              go build -trimpath \
+                -ldflags "-s -w -X main.version=${VERSION}" \
+                -o "${GITHUB_WORKSPACE}/dist/abctl" . )
+            tar -C dist -czf "dist/abctl_${VERSION}_${os}_${arch}.tar.gz" abctl
+            rm -f dist/abctl
+
+            for entry in "${proxy_variants[@]}"; do
+              build_proxy "${entry%%:*}" "${entry#*:}" "${os}" "${arch}"
             done
           done
           ( cd dist && sha256sum ./*.tar.gz > checksums.txt )
@@ -72,9 +103,21 @@ jobs:
         run: |
           set -euo pipefail
           TAG="${GITHUB_REF_NAME}"
-          notes="Prebuilt \`abctl\` and \`authbridge-proxy\` binaries for linux and macOS (amd64/arm64).
-
-          Verify downloads with \`sha256sum -c checksums.txt\`. On macOS, clear the Gatekeeper quarantine after extracting: \`xattr -dr com.apple.quarantine ./abctl\`."
+          # Build release notes one line at a time so no single string
+          # exceeds yamllint's 150-char cap. Single-quoted arguments keep
+          # backticks literal (no shell expansion).
+          notes=""
+          add() { notes="${notes}${1}"$'\n'; }
+          add 'Prebuilt `abctl` and `authbridge-proxy` binaries for linux and macOS (amd64/arm64).'
+          add ''
+          add '`authbridge-proxy` ships in variants matching the container images:'
+          add 'unqualified (default plugin set, matches the `authbridge` image),'
+          add '`-lite` (auth-only, matches `authbridge-lite`), plus one variant per'
+          add 'opt-in plugin currently offered for try-out (today: `-sessionbudget`).'
+          add 'Variants track opt-in plugins one-for-one; arbitrary combinations are not published.'
+          add ''
+          add 'Verify downloads with `sha256sum -c checksums.txt`. On macOS, clear the'
+          add 'Gatekeeper quarantine after extracting: `xattr -dr com.apple.quarantine ./abctl`.'
           if gh release view "${TAG}" >/dev/null 2>&1; then
             gh release upload "${TAG}" dist/*.tar.gz dist/checksums.txt --clobber
           else
diff --git a/authbridge/CLAUDE.md b/authbridge/CLAUDE.md
index d79a4bb8..202d4c14 100644
--- a/authbridge/CLAUDE.md
+++ b/authbridge/CLAUDE.md
@@ -34,6 +34,24 @@ binaries with shared auth logic in `authlib/`:
 Each binary is hardcoded to its deployment shape; mode is no longer selected
 at runtime. The YAML `mode:` field must match the binary or boot fails.
 
+### Release binaries
+
+`v*` tag pushes trigger `.github/workflows/release-binaries.yaml`, which
+cross-compiles `authbridge-proxy` and `abctl` for linux/darwin ×
+amd64/arm64 and attaches tarballs to the GitHub Release. `authbridge-proxy`
+ships in variants that mirror the container images:
+
+| Variant | Tarball name shape | Matches |
+|---|---|---|
+| unqualified (default plugins) | `authbridge-proxy_<ver>_<os>_<arch>.tar.gz` | `authbridge` image |
+| `-lite` (drops the OPA SDK and the protocol parsers) | `authbridge-proxy-lite_<ver>_<os>_<arch>.tar.gz` | `authbridge-lite` image |
+| `-sessionbudget` (default + opt-in session-budget) | `authbridge-proxy-sessionbudget_<ver>_<os>_<arch>.tar.gz` | no image today |
+
+One variant per opt-in plugin currently offered for try-out (today:
+`-sessionbudget`) — never enumerate combos. To add one, append to the
+`proxy_variants` array in the workflow. `authbridge-cpex` stays image-only
+(needs cgo); `context-guru` is opt-in but not yet offered as a variant.
+
 See [`authlib/README.md`](authlib/README.md) for the library reference.
 
 ## What AuthBridge Does