diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..87ff93e
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,54 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+-*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 20.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20.x"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build plugin
+        run: npm run build
+
+      - name: Verify manifest version matches tag
+        run: |
+          tag="${GITHUB_REF#refs/tags/}"
+          manifest_version=$(node -p "require('./manifest.json').version")
+          if [ "$tag" != "$manifest_version" ]; then
+            echo "::error::Tag '$tag' does not match manifest.json version '$manifest_version'."
+            echo "Run 'npm version $tag' locally to bump all files in sync, then push the tag."
+            exit 1
+          fi
+
+      - name: Create GitHub release
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          tag="${GITHUB_REF#refs/tags/}"
+          if [[ "$tag" == *-* ]]; then
+            prerelease_flag="--prerelease"
+          else
+            prerelease_flag=""
+          fi
+          gh release create "$tag" \
+            --title "$tag" \
+            --notes "Release $tag" \
+            $prerelease_flag \
+            main.js manifest.json styles.css
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..07baf5b
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+tag-version-prefix=
diff --git a/package.json b/package.json
index 35f8a8b..e497f78 100644
--- a/package.json
+++ b/package.json
@@ -7,7 +7,8 @@
     "lint": "svelte-check --tsconfig tsconfig.json --fail-on-hints && eslint . --ext .ts",
     "test:unit": "vitest",
     "dev": "rollup --config rollup.config.js -w",
-    "build": "npm run lint && rollup --config rollup.config.js --environment BUILD:production"
+    "build": "npm run lint && rollup --config rollup.config.js --environment BUILD:production",
+    "version": "node version-bump.mjs && git add manifest.json versions.json"
   },
   "keywords": [],
   "author": "",
diff --git a/version-bump.mjs b/version-bump.mjs
new file mode 100644
index 0000000..b363727
--- /dev/null
+++ b/version-bump.mjs
@@ -0,0 +1,21 @@
+import { readFileSync, writeFileSync } from "fs";
+
+const targetVersion = process.env.npm_package_version;
+if (!targetVersion) {
+  throw new Error(
+    "npm_package_version is not set; run this via `npm version <x.y.z[-pre]>`."
+  );
+}
+
+const manifest = JSON.parse(readFileSync("manifest.json", "utf8"));
+const { minAppVersion } = manifest;
+manifest.version = targetVersion;
+writeFileSync("manifest.json", JSON.stringify(manifest, null, 2) + "\n");
+
+const versions = JSON.parse(readFileSync("versions.json", "utf8"));
+versions[targetVersion] = minAppVersion;
+writeFileSync("versions.json", JSON.stringify(versions, null, 2) + "\n");
+
+console.log(
+  `Synced manifest.json and versions.json to ${targetVersion} (minAppVersion ${minAppVersion}).`
+);