diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 00000000..978c5f1d
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,53 @@
+name: Release
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # need full tag history
+
+      - name: Compute next version
+        id: ver
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # Bump the patch of the HIGHEST existing GitHub Release (independent of
+          # the in-code version). Only the patch increments, so you can publish a
+          # higher major/minor by hand (e.g. v1.1.0) and the next merge continues
+          # from there (-> v1.1.1). First run only (no release yet): seed v1.0.0.
+          latest=$(gh release list --limit 1000 --json tagName --jq '.[].tagName' | sort -V | tail -n1)
+          if [ -z "$latest" ]; then
+            next="v1.0.0"
+          else
+            core=${latest#v}; core=${core%%.post*}; core=${core%%-*}
+            IFS='.' read -r major minor patch <<< "$core"
+            next="v${major}.${minor}.$((patch + 1))"
+          fi
+          echo "Latest release: ${latest:-none}  Next: $next"
+          echo "tag=$next" >> "$GITHUB_OUTPUT"
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ steps.ver.outputs.tag }}" \
+            --target "${{ github.event.pull_request.merge_commit_sha }}" \
+            --title "${{ steps.ver.outputs.tag }}" \
+            --generate-notes