diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..7184770
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,50 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Verify tag matches Drip::VERSION
+        run: |
+          version="$(bundle exec ruby -Ilib -e 'require "drip/version"; print Drip::VERSION')"
+          if [ "${GITHUB_REF_NAME}" != "v${version}" ]; then
+            echo "tag ${GITHUB_REF_NAME} does not match Drip::VERSION v${version}" >&2
+            exit 1
+          fi
+
+      - name: Extract release notes from CHANGELOG.md
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v v="$version" '
+            /^## \[/ { in_section = index($0, "## [" v "]") == 1; next }
+            in_section { print }
+          ' CHANGELOG.md > release-notes.md
+          if ! grep -q '[^[:space:]]' release-notes.md; then
+            echo "no CHANGELOG.md section found for ${version}" >&2
+            exit 1
+          fi
+
+      - uses: rubygems/release-gem@v1
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" pkg/*.gem \
+            --title "${GITHUB_REF_NAME}" \
+            --notes-file release-notes.md \
+            --verify-tag
diff --git a/README.md b/README.md
index b660979..4d03639 100644
--- a/README.md
+++ b/README.md
@@ -235,3 +235,14 @@ subscriber.email
 3. Commit your changes (`git commit -am 'Add some feature'`)
 4. Push to the branch (`git push origin my-new-feature`)
 5. Create a new Pull Request
+
+## Releasing
+
+1. Set `Drip::VERSION` in `lib/drip/version.rb`.
+2. Move the `[Unreleased]` entries in `CHANGELOG.md` under a new `## [x.y.z] - YYYY-MM-DD` heading.
+3. Merge to `main`.
+4. From an up-to-date `main`, tag and push: `git tag -a vX.Y.Z -m vX.Y.Z && git push origin vX.Y.Z`.
+
+Pushing the tag triggers `.github/workflows/release.yml`, which checks that the
+tag matches `Drip::VERSION`, publishes the gem to RubyGems, and creates the
+GitHub release with the matching `CHANGELOG.md` section as its notes.