diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..6e7dd8b
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,45 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  publish-gem:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    name: gem push
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@0cb964fd540e0a24c900370abf38a33466142735 # v1.305.0
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Verify release tag matches Threencr::VERSION
+        run: |
+          set -euo pipefail
+          manifest_version=$(grep -E '^\s*VERSION = "' lib/threencr/version.rb | head -1 | cut -d'"' -f2)
+          tag="${GITHUB_REF#refs/tags/}"
+          tag_version="${tag#v}"
+          if [ "$manifest_version" != "$tag_version" ]; then
+            echo "::error::Threencr::VERSION ($manifest_version) does not match release tag ($tag)"
+            exit 1
+          fi
+          echo "Publishing 3ncr $manifest_version"
+
+      - name: Run tests
+        run: bundle exec rake test
+
+      - name: Build gem
+        run: gem build 3ncr.gemspec
+
+      - name: Push to RubyGems
+        env:
+          GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
+        run: gem push 3ncr-*.gem