diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..5116ec7
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,67 @@
+name: Release
+
+# Publishes to npm on a version tag push. Uses npm trusted publishing
+# (OIDC) instead of a long-lived NPM_TOKEN secret — the trusted publisher
+# must be configured on npmjs.com for this repo + this workflow file
+# before the first run (npmjs.com -> usecharming package -> Settings ->
+# Trusted Publisher). Requires npm CLI >= 11.5.1, hence the explicit
+# `npm install -g npm@latest` below.
+#
+# A tag alone doesn't publish: `bun run check` (the same gate ci.yml
+# runs) must pass, and the tag must match package.json's version.
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the GitHub Release
+      id-token: write # npm trusted publishing (OIDC)
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v6.0.0
+        with:
+          node-version: 22
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm install -g npm@latest
+
+      - run: bun install --frozen-lockfile
+
+      - run: bun run check
+
+      - name: Verify tag matches package.json version
+        run: |
+          pkg=$(node -p "require('./package.json').version")
+          tag="${GITHUB_REF_NAME#v}"
+          if [ "$pkg" != "$tag" ]; then
+            echo "tag v$tag does not match package.json version $pkg" >&2
+            exit 1
+          fi
+
+      - name: Smoke-test the packed tarball
+        run: |
+          tarball=$(npm pack --silent)
+          mkdir -p /tmp/smoke && cd /tmp/smoke && npm init -y >/dev/null
+          npm install "$GITHUB_WORKSPACE/$tarball"
+          ./node_modules/.bin/charming --version
+          ./node_modules/.bin/charming --help
+
+      - run: npm publish
+        # No NODE_AUTH_TOKEN: the trusted publisher on npmjs.com supplies
+        # credentials via OIDC and attaches a provenance attestation.
+
+      - run: gh release create "$GITHUB_REF_NAME" --generate-notes --verify-tag
+        env:
+          GH_TOKEN: ${{ github.token }}