diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..eeef67cb
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,42 @@
+name: "Create GitHub release"
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      # create release artefact before creating the release to get the correct release in the
+      # artefact name.
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Make dist
+
+      # crate release, which will bump the version
+      - name: Upstream release
+        uses: osbuild/release-action@main
+        with:
+          token: "${{ secrets.SCHUTZBOT_GITHUB_ACCESS_TOKEN }}"
+          slack_webhook_url: "${{ secrets.SLACK_WEBHOOK_URL }}"
+
+      # upload release artefact
+      # Source0 expands to `https://github.com/osbuild/image-builder-frontend/releases/download/v$VERSION/cockpit-image-builder-v$VERSION.tar.gz`,
+      # so the v needs to be in the tarball when we upload it as a release artefact.
+      - name: Upload release artefact
+        run: |
+          RELEASE_NO = $(echo ${{github.event.release.tag_name}} | tr -d 'v')
+          mv "cockpit-image-builder-$RELEASE_NO.tar.gz" cockpit-image-builder-${{github.event.release.tag_name}}.tar.gz
+          gh release upload ${{github.event.release.tag_name}} \
+            cockpit-image-builder-${{github.event.release.tag_name}}.tar.gz