diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..2e49633
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,72 @@
+name: Release
+
+# Publishes a tagged version. Runs the full suite, creates a GitHub Release
+# with the packed tarball, and — when an NPM_TOKEN secret is present —
+# publishes @yrstm/mantis to npm with provenance.
+#
+# Tags are created by the "Release cleanup" workflow (it pushes through the
+# Actions token, since session branches cannot push tags); this workflow runs
+# on the resulting tag. It can also be re-run for an existing tag via dispatch.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to (re)release, e.g. v0.3.5"
+        required: true
+
+permissions:
+  contents: write
+  id-token: write # npm provenance
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      HAS_NPM_TOKEN: ${{ secrets.NPM_TOKEN != '' }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - run: npm ci
+      - run: npm test
+      - run: npm run types:check
+      - run: npm pack
+
+      # the tag must match package.json — a mismatch means the version bump or
+      # the tag is wrong, and we stop before publishing anything
+      - name: Tag matches package.json version
+        run: |
+          tag="${{ github.event.inputs.tag || github.ref_name }}"
+          pkg="v$(node -p "require('./package.json').version")"
+          if [ "$tag" != "$pkg" ]; then
+            echo "tag $tag does not match package.json $pkg"
+            exit 1
+          fi
+
+      - name: GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
+          generate_release_notes: true
+          files: "*.tgz"
+
+      # only when the maintainer has added an NPM_TOKEN secret; without it the
+      # GitHub Release above is still produced and the job stays green
+      - name: Publish to npm
+        if: env.HAS_NPM_TOKEN == 'true'
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: npm publish skipped (no NPM_TOKEN)
+        if: env.HAS_NPM_TOKEN != 'true'
+        run: echo "NPM_TOKEN not set - GitHub Release created, npm publish skipped."