diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..0848163
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,29 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  id-token: write # Required for NPM trusted publishing.
+  contents: read
+
+jobs:
+  npm:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: latest
+          package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
+      - run: npm install --ignore-scripts --package-lock=false
+      - run: npm test
+      - run: npm stage publish # Runs prepublish script.
diff --git a/package.json b/package.json
index 1a129b6..91e7f62 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,9 @@
     "url"
   ],
   "repository": "pillarjs/encodeurl",
+  "publishConfig": {
+    "tag": "latest-2.x"
+  },
   "funding": {
     "type": "opencollective",
     "url": "https://opencollective.com/express"