diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..9c0ffd0
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,80 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: "Version bump (patch | minor | major)"
+        required: true
+        default: patch
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write          # allow push + release
+
+    steps:
+    - uses: actions/checkout@v4       # first-party
+      with:
+        fetch-depth: 0                # we need all tags
+
+    - uses: actions/setup-go@v5       # first-party
+      with:
+        go-version: '1.22'
+
+    # ───────── 1. figure out next tag ─────────
+    - id: version
+      shell: bash
+      run: |
+        last=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
+        echo "previous=$last" >>"$GITHUB_OUTPUT"
+
+        v=${last#v}; IFS=. read -r major minor patch <<<"$v"
+        case "${{ github.event.inputs.bump }}" in
+          patch) patch=$((patch+1));;
+          minor) minor=$((minor+1)); patch=0;;
+          major) major=$((major+1)); minor=0; patch=0;;
+        esac
+        next="v${major}.${minor}.${patch}"
+        echo "next=$next" >>"$GITHUB_OUTPUT"
+
+    # ───────── 2. update CHANGELOG.md ─────────
+    - name: Update changelog
+      shell: bash
+      run: |
+        next=${{ steps.version.outputs.next }}
+        prev=${{ steps.version.outputs.previous }}
+
+        {
+          echo "## $next"
+          echo
+          git log "$prev"..HEAD --pretty=format:"- %s"
+          echo
+          cat CHANGELOG.md 2>/dev/null || true
+        } >CHANGELOG.tmp
+        mv CHANGELOG.tmp CHANGELOG.md
+        git config user.name  "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add CHANGELOG.md
+        git commit -m "docs: update changelog for $next"
+
+    # ───────── 3. tag & push ─────────
+    - name: Tag and push
+      shell: bash
+      run: |
+        tag=${{ steps.version.outputs.next }}
+        git tag -s "$tag" -m "Release $tag" || git tag -a "$tag" -m "Release $tag"
+        git push origin HEAD:main
+        git push origin "$tag"
+
+    # ───────── 4. create & upload release ─────────
+    - name: Create GitHub release
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      shell: bash
+      run: |
+        tag=${{ steps.version.outputs.next }}
+        gh release create "$tag" dist/* \
+          --title "$tag" \
+          --generate-notes