diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dc043c8..05d7f30 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,3 +64,18 @@ jobs:
         env:
           PYPI_REGISTRY_TOKEN: ${{ secrets.PYPI_REGISTRY_TOKEN }}
         run: poetry publish --build --username __token__ --password "$PYPI_REGISTRY_TOKEN"
+
+  # Publishing the package and announcing it are separate concerns: this job is
+  # kept apart from `publish` so the credential-bearing job keeps `contents: read`.
+  release:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          # A SemVer pre-release suffix is the only place a hyphen appears in the tag.
+          prerelease: ${{ contains(github.ref_name, '-') }}