diff --git a/.github/workflows/build-syncthing.yaml b/.github/workflows/build-syncthing.yaml
index ba2f55e57..966e23cd5 100644
--- a/.github/workflows/build-syncthing.yaml
+++ b/.github/workflows/build-syncthing.yaml
@@ -459,6 +459,7 @@ jobs:
         with:
           name: packages-signed
           path: packages/*
+
   #
   # Debian
   #
@@ -505,3 +506,47 @@ jobs:
         with:
           name: debian-packages
           path: "*.deb"
+
+  #
+  # Nightlies
+  #
+
+  publish-nightly:
+    name: Publish nightly build
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release-nightly')
+    environment: signing
+    needs:
+      - sign-for-upgrade
+      - notarize-macos
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          repository: syncthing/release-tools
+          path: tools
+          fetch-depth: 0
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: packages-signed
+          path: packages
+
+      - name: Create release json
+        run: |
+          cd packages
+          "$GITHUB_WORKSPACE/tools/generate-release-json" "$BASE_URL" > nightly.json
+        env:
+          BASE_URL: https://syncthing.ams3.digitaloceanspaces.com/nightly/
+
+      - name: Push artifacts
+        uses: docker://docker.io/rclone/rclone:latest
+        env:
+          RCLONE_CONFIG_SPACES_TYPE: s3
+          RCLONE_CONFIG_SPACES_PROVIDER: DigitalOcean
+          RCLONE_CONFIG_SPACES_ACCESS_KEY_ID: ${{ secrets.SPACES_KEY }}
+          RCLONE_CONFIG_SPACES_SECRET_ACCESS_KEY: ${{ secrets.SPACES_SECRET }}
+          RCLONE_CONFIG_SPACES_ENDPOINT: ams3.digitaloceanspaces.com
+          RCLONE_CONFIG_SPACES_ACL: public-read
+        with:
+          args: sync packages spaces:syncthing/nightly
diff --git a/.github/workflows/trigger-nightly.yaml b/.github/workflows/trigger-nightly.yaml
new file mode 100644
index 000000000..e50a9188c
--- /dev/null
+++ b/.github/workflows/trigger-nightly.yaml
@@ -0,0 +1,21 @@
+name: Trigger nightly build & release
+on:
+  workflow_dispatch:
+  schedule:
+    # Run nightly build at 01:00 UTC
+    - cron: '00 01 * * *'
+
+jobs:
+
+  trigger-nightly:
+    runs-on: ubuntu-latest
+    name: Push to release-nightly to trigger build
+    steps:
+
+      - uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.ACTIONS_GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - run: |
+          git push origin main:release-nightly
diff --git a/Dockerfile.stupgrades b/Dockerfile.stupgrades
index b5caf44a9..896d83e82 100644
--- a/Dockerfile.stupgrades
+++ b/Dockerfile.stupgrades
@@ -15,9 +15,4 @@ EXPOSE 8080
 
 COPY --from=builder /src/stupgrades /bin/stupgrades
 
-ENTRYPOINT [ \
-	"/bin/stupgrades", \
-	"-f", "/nightly.json->https://build.syncthing.net/guestAuth/repository/download/Release_Nightly/.lastSuccessful/nightly.json", \
-	"-f", "/syncthing-macos/appcast.xml->https://build.syncthing.net/guestAuth/repository/download/SyncthingMacOS_CreateAppcastXml/.lastSuccessful/appcast.xml" \
-	]
-
+ENTRYPOINT [ "/bin/stupgrades" ]
diff --git a/build.go b/build.go
index a96eb91ef..cca95f989 100644
--- a/build.go
+++ b/build.go
@@ -1108,10 +1108,14 @@ func getBranchSuffix() string {
 
 	branch = parts[len(parts)-1]
 	switch branch {
-	case "master", "release", "main":
+	case "release", "main":
 		// these are not special
 		return ""
 	}
+	if strings.HasPrefix(branch, "release-") {
+		// release branches are not special
+		return ""
+	}
 
 	validBranchRe := regexp.MustCompile(`^[a-zA-Z0-9_.-]+$`)
 	if !validBranchRe.MatchString(branch) {