diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 0c35a9c..0fa69b0 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -11,14 +11,9 @@ permissions:
   push:
     branches:
       - main
-    tags-ignore:
-      - '**'
-    paths-ignore:
-      - '**/*.md'
-      - LICENSE
-      - '**/*.gitignore'
-      - .editorconfig
-      - docs/**
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+*'
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
   pull_request: null
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -356,6 +351,7 @@ jobs:
         run: test -s example-input_enhanced.wav
   publish:
     name: Publish
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     needs:
       - lint
@@ -386,18 +382,18 @@ jobs:
         shell: bash
       - name: Publish
         run: |
-          npm config set provenance true
-          if git log -1 --pretty=%B | grep "^v\?[0-9]\+\.[0-9]\+\.[0-9]\+$";
-          then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --access public
-          elif git log -1 --pretty=%B | grep "^v\?[0-9]\+\.[0-9]\+\.[0-9]\+";
-          then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --tag next --access public
-          else
-            echo "Not a release, skipping publish"
+          VERSION="${GITHUB_REF_NAME#v}"
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+          if [ "$VERSION" != "$PACKAGE_VERSION" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $PACKAGE_VERSION"
+            exit 1
           fi
+          npm config set provenance true
+          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
+          case "$VERSION" in
+            *-*) npm publish --tag next --access public ;;
+            *) npm publish --access public ;;
+          esac
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
new file mode 100644
index 0000000..d1b009d
--- /dev/null
+++ b/DEVELOPMENT.md
@@ -0,0 +1,35 @@
+# Development
+
+Requires a recent Rust toolchain and Node 18+.
+
+```bash
+pnpm install
+pnpm build            # release build; use build:debug while iterating
+pnpm pretest          # download model fixtures into __test__/data
+AIC_SDK_LICENSE=<key> pnpm test
+```
+
+The native library for the host target is downloaded during `cargo build`, so the first
+build needs network access.
+
+To benchmark, point the harness at a model file:
+
+```bash
+AIC_SDK_LICENSE=<key> AIC_SDK_MODEL=__test__/data/<model>.aicmodel pnpm bench
+```
+
+## Releasing
+
+The npm version tracks the version of the `aic-sdk` Rust crate it wraps. Bump
+`package.json`, `Cargo.toml` (both the package version and the `aic-sdk` dependency) and
+`Cargo.lock` together, add a `CHANGELOG.md` entry, and merge that to `main`. Then tag the
+merge commit:
+
+```bash
+git tag x.x.x && git push origin x.x.x
+```
+
+Pushing the tag builds all six targets, runs the tests and examples, and publishes to npm.
+The tag must match the version in `package.json` or the publish step fails. A tag with a
+prerelease suffix, such as `0.24.0-rc.1`, publishes under the `next` dist-tag instead of
+`latest`.
diff --git a/README.md b/README.md
index 2c8801a..ab16910 100644
--- a/README.md
+++ b/README.md
@@ -302,23 +302,8 @@ Cleanup timing also affects native memory usage:
 
 ## Development
 
-Requires a recent Rust toolchain and Node 18+.
-
-```bash
-pnpm install
-pnpm build            # release build; use build:debug while iterating
-pnpm pretest          # download model fixtures into __test__/data
-AIC_SDK_LICENSE=<key> pnpm test
-```
-
-The native library for the host target is downloaded during `cargo build`, so the first
-build needs network access.
-
-To benchmark, point the harness at a model file:
-
-```bash
-AIC_SDK_LICENSE=<key> AIC_SDK_MODEL=__test__/data/<model>.aicmodel pnpm bench
-```
+Building, testing, benchmarking and releasing this package are covered in
+[DEVELOPMENT.md](DEVELOPMENT.md).
 
 ## License