diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 94a85ae..7f3ed39 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -39,6 +39,38 @@ jobs:
       - name: Type-check
         run: bun run build
 
+  release:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: verify
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check if version tag exists
+        id: check
+        run: |
+          VERSION=$(jq -r .version package.json)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          if git ls-remote --tags origin | grep -q "refs/tags/v${VERSION}$"; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create release
+        if: steps.check.outputs.exists == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "v${{ steps.check.outputs.version }}" \
+            --title "v${{ steps.check.outputs.version }}" \
+            --generate-notes
+
   build-and-push-image:
     if: github.event_name != 'pull_request'
     needs: verify
@@ -51,7 +83,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Log in to the Container registry
+      - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -71,3 +103,11 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Make package public on ghcr.io
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api --method PATCH \
+            /orgs/orkait/packages/container/hyperstack \
+            -f visibility=public
diff --git a/Dockerfile b/Dockerfile
index 1262e54..12dc5af 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 FROM oven/bun:alpine
 WORKDIR /app
-COPY package.json bun.lockb ./
+COPY package.json bun.lock ./
 RUN bun install --frozen-lockfile
 COPY src/ src/
 USER bun
diff --git a/package.json b/package.json
index dd1e010..1b41b90 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@orkait-ai/hyperstack",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Disciplined MCP server + skill system. 11 plugins, 79 tools, 21 skills with adversarial enforcement. Designer/DESIGN.md pipeline, shadcn/ui, React Flow, Motion, Lenis, React 19, Echo, Go, Rust, design tokens, UI/UX.",
   "bin": {
     "hyperstack": "bin/hyperstack.mjs"
diff --git a/tests/workflow-behaviour.test.ts b/tests/workflow-behaviour.test.ts
index b64a210..d335a47 100644
--- a/tests/workflow-behaviour.test.ts
+++ b/tests/workflow-behaviour.test.ts
@@ -20,4 +20,5 @@ test("publish workflow verifies the package across the supported OS and Bun matr
     /if:\s*github\.event_name\s*!=\s*'pull_request'/,
     "publish job should not push images from pull request runs",
   );
+  assert.match(workflow, /gh release create/, "workflow should auto-create a release on version bump");
 });