diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 700f867..7fea539 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -7,6 +7,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
       - uses: psf/black@stable
diff --git a/.github/workflows/pyinstaller.yml b/.github/workflows/pyinstaller.yml
new file mode 100644
index 0000000..2e09e3e
--- /dev/null
+++ b/.github/workflows/pyinstaller.yml
@@ -0,0 +1,30 @@
+name: pyinstaller
+
+on: [push]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: prep
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pipenv pyinstaller==6.3.0
+          pipenv install
+          rm -rf build dist
+      - name: build
+        shell: bash
+        run: |
+          pipenv --venv
+          pipenv run pyinstaller run.py --hidden-import chkbit --hidden-import chkbit_cli --onefile --name chkbit --console --paths $(pipenv --venv)/lib/*/site-packages
+          cat build/chkbit/warn-chkbit.txt
+      - name: artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: chkbit
+          path: dist/chkbit
diff --git a/.gitignore b/.gitignore
index 9125d71..8dec0f7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
 README.rst
+build/
 dist/
+chkbit.spec
 .cache/
 .chkbit
 .pytest_cache/
diff --git a/Pipfile b/Pipfile
index 9b913f5..80745a1 100644
--- a/Pipfile
+++ b/Pipfile
@@ -3,6 +3,7 @@ url = "https://pypi.org/simple"
 verify_ssl = true
 name = "pypi"
 
+# keep in sync with pyproject.toml
 [packages]
 blake3 = ">=0.3.4"
 
diff --git a/chkbit/hashfile.py b/chkbit/hashfile.py
index a7d2a06..5f6cfda 100644
--- a/chkbit/hashfile.py
+++ b/chkbit/hashfile.py
@@ -1,4 +1,5 @@
 import hashlib
+from blake3 import blake3
 from typing import Callable
 
 
@@ -11,8 +12,6 @@ def hashfile(path: str, hash_algo: str, *, hit: Callable[[str], None]):
     elif hash_algo == "sha512":
         h = hashlib.sha512()
     elif hash_algo == "blake3":
-        from blake3 import blake3
-
         h = blake3()
     else:
         raise Exception(f"algo '{hash_algo}' is unknown.")
diff --git a/chkbit_cli/__init__.py b/chkbit_cli/__init__.py
new file mode 100644
index 0000000..ac4bdc0
--- /dev/null
+++ b/chkbit_cli/__init__.py
@@ -0,0 +1,5 @@
+from chkbit_cli.cli import CLI
+from chkbit_cli.progress import Progress
+from chkbit_cli.sparklines import sparkify
+from chkbit_cli.rate_calc import RateCalc
+from chkbit_cli.main import Main, main
diff --git a/pyproject.toml b/pyproject.toml
index f110284..141f464 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,6 +5,8 @@ description = "chkbit checks the data integrity of your files"
 authors = [
     {name = "Christian Zangl", email = "laktak@cdak.net"},
 ]
+
+# keep in sync with Pipfile
 dependencies = [
   "blake3>=0.3.4",
 ]
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..3e7a730
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1 @@
+blake3>=0.3.4
diff --git a/run.py b/run.py
new file mode 100644
index 0000000..154d848
--- /dev/null
+++ b/run.py
@@ -0,0 +1,4 @@
+from chkbit_cli import main
+
+if __name__ == "__main__":
+    main()