diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e311ede..35a0870 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_call:
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..2990be7
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,54 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+jobs:
+  ci:
+    name: Run CI
+    uses: ./.github/workflows/ci.yml
+
+  validate:
+    name: Validate version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check version matches tag
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          CARGO_VERSION=$(cargo metadata --format-version=1 --no-deps | jq -r '.packages[] | select(.name == "cargo-hyperlight") | .version')
+          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
+            echo "Error: Tag version ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
+            exit 1
+          fi
+          echo "Version validated: $TAG_VERSION"
+
+  publish:
+    name: Publish to crates.io
+    needs: [ci, validate]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - name: Publish
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_PUBLISH_TOKEN }}
+
+  release:
+    name: Create GitHub Release
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --title "$GITHUB_REF_NAME" \
+            --generate-notes
diff --git a/README.md b/README.md
index 862ca9a..a5439f5 100644
--- a/README.md
+++ b/README.md
@@ -86,3 +86,13 @@ cargo hyperlight build --release
 Your binary will be built for the `x86_64-hyperlight-none` target by default, and placed in `target/x86_64-hyperlight-none/release/guest`.
 
 There's no need for any extra configuration, the command will take care of everything.
+
+## Releasing
+
+To publish a new version:
+
+1. Update the version in `Cargo.toml`
+2. Commit the change: `git commit -S -s -am  "Bump version to X.Y.Z"` and open a PR
+3. Create and push a tag: `git tag -s vX.Y.Z && git push origin vX.Y.Z`
+
+The CI will automatically run tests, publish to crates.io, and create a GitHub release.