diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8664ee0e..7eaa527f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,7 @@ name: CI
 on:
   push:
     branches: ["trunk"]
+    tags: ["v*"]
   pull_request:
     branches: ["trunk"]
 
@@ -24,6 +25,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - uses: actions/setup-python@v5.3.0
       with:
@@ -52,6 +55,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: apt install
       run: |
@@ -78,3 +83,28 @@ jobs:
         name: dist
         path: dist/*.*
         if-no-files-found: error
+
+  release:
+    name: "release"
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [build]
+
+    permissions:
+      contents: write
+
+    steps:
+
+    - uses: actions/download-artifact@v4
+      with:
+        name: dist
+        path: dist/
+
+    - run: |
+        gh release create "${TAG_REF:##*/}" \
+            --verify-tag \
+            --title "Yarrharr ${TAG_REF:##*/v}" \
+            --generate-notes \
+            dist/yarrharr-*.tar.gz \
+            dist/yarrharr-*.whl
+      environment:
+        TAG_REF: ${{ github.ref }}