diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..3630477
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,117 @@
+# Publishes the release drafted by draft-release.yml. Runs when the release PR lands on main
+# (or manually, as a fallback / dry run): detects the pending draft from CHANGELOG.md, runs the
+# tests without any write access, then un-drafts the GitHub Release from the `release`
+# environment. Un-drafting creates the tag, and Packagist picks the version up from it.
+name: Release
+on:
+  push:
+    branches: [main]
+    paths: [CHANGELOG.md]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run: detect the release and run the tests, but do not publish"
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  detect:
+    name: Detect pending release
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.pending.outputs.tag }}
+      go: ${{ steps.decide.outputs.go }}
+    steps:
+      - name: Refuse to release from a non-default branch
+        env:
+          REF: ${{ github.ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          if [ "$REF" != "refs/heads/$DEFAULT_BRANCH" ]; then
+            echo "::error::Releases must run from $DEFAULT_BRANCH, got $REF"
+            exit 1
+          fi
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Resolve pending release
+        id: pending
+        uses: railsware/github-actions/resolve-pending-release@master
+        with:
+          tag-prefix: "" # tags are bare X.Y.Z
+
+      # push: skip quietly when nothing is pending (an ordinary CHANGELOG edit).
+      # dispatch: a real run needs an unreleased version; a dry run doesn't. detect can't see drafts
+      # (read-only token), so the publish job confirms the draft after approval.
+      - name: Decide
+        id: decide
+        env:
+          EVENT: ${{ github.event_name }}
+          PENDING: ${{ steps.pending.outputs.pending }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          echo "pending=$PENDING dry_run=$DRY_RUN"
+          if [ "$DRY_RUN" = "true" ] && [ "$PENDING" != "true" ]; then
+            echo "::warning::The top CHANGELOG.md version is already released, so this dry run doesn't exercise detection"
+          fi
+          if [ "$PENDING" = "true" ] || [ "$DRY_RUN" = "true" ]; then
+            echo "go=true" >> "$GITHUB_OUTPUT"
+          elif [ "$EVENT" = "workflow_dispatch" ]; then
+            echo "::error::The top CHANGELOG.md version is already released; run Draft PHP Release first"
+            exit 1
+          else
+            echo "Nothing to release"
+            echo "go=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  test:
+    name: Test
+    needs: detect
+    if: needs.detect.outputs.go == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: '8.4'
+          extensions: mbstring, intl, curl
+          coverage: none
+
+      - name: Validate, install, test
+        run: |
+          composer validate
+          composer install --prefer-dist --no-progress
+          composer test
+
+  release:
+    name: Publish
+    needs: [detect, test]
+    if: ${{ !inputs.dry_run }}
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write # edit and un-draft the release
+    steps:
+      - name: Check GitHub release
+        uses: railsware/github-actions/check-sdk-github-release@master
+        with:
+          tag: ${{ needs.detect.outputs.tag }}
+
+      - name: Publish GitHub release
+        uses: railsware/github-actions/publish-github-release@master
+        with:
+          tag: ${{ needs.detect.outputs.tag }}
+          target: ${{ github.sha }}