diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f9918d..b4b49bf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,10 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
+    - name: install deps
+      run: |
+        choco install upx
+
     - name: build32
       run: |
         mkdir build32
diff --git a/CMakeLists.txt b/CMakeLists.txt
index dc82733..715f59b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -5,6 +5,11 @@ if(NOT MSVC)
     message(FATAL_ERROR "pegoat can only be built on Windows")
 endif()
 
+find_program(PEGOAT_UPX "upx")
+if(NOT PEGOAT_UPX)
+    message(FATAL_ERROR "pegoat needs UPX")
+endif()
+
 add_executable(pegoat goat.cpp)
 
 # An executable with no stack guards.
@@ -84,3 +89,25 @@ add_custom_command(
   COMMAND
   powershell -ExecutionPolicy Bypass -File sign-nested.ps1 $<TARGET_FILE:pegoat-authenticode-nested>
 )
+
+add_executable(pegoat-upx-packed goat.cpp)
+add_custom_command(
+  TARGET
+  POST_BUILD
+  pegoat-upx-packed
+  WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
+  COMMAND
+  upx $<TARGET_FILE:pegoat-upx-packed>
+)
+
+add_executable(pegoat-upx-packed-authenticode goat.cpp)
+add_custom_command(
+  TARGET
+  POST_BUILD
+  pegoat-upx-packed-authenticode
+  WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
+  COMMAND
+  upx $<TARGET_FILE:pegoat-upx-packed-authenticode>
+  COMMAND
+  powershell -ExecutionPolicy Bypass -File sign.ps1 $<TARGET_FILE:pegoat-upx-packed-authenticode>
+)