diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..3f304f2
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,33 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Unlock keychain for signing
+        run: security unlock-keychain -p "" ~/Library/Keychains/login.keychain-db 2>/dev/null || true
+
+      - name: Build and package
+        run: |
+          ./build-app.sh
+          mkdir -p dist
+          ditto -c -k --keepParent Kapture.app dist/Kapture.zip
+          shasum -a 256 dist/Kapture.zip
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ github.ref_name }}" dist/Kapture.zip \
+            --title "${{ github.ref_name }}" \
+            --generate-notes
diff --git a/release.sh b/release.sh
new file mode 100644
index 0000000..5c16d16
--- /dev/null
+++ b/release.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+set -euo pipefail
+cd "$(dirname "$0")"
+
+if [ "$#" -ne 1 ]; then
+    echo "usage: $0 <version>    e.g. ./release.sh 1.0.1" >&2
+    exit 1
+fi
+VERSION="$1"
+
+./build-app.sh
+
+mkdir -p dist
+rm -f dist/Kapture.zip
+ditto -c -k --keepParent Kapture.app dist/Kapture.zip
+shasum -a 256 dist/Kapture.zip
+
+echo
+echo "Tag and release with:"
+echo "  git tag v$VERSION && git push origin v$VERSION"
+echo "The GitHub Actions release workflow will upload dist/Kapture.zip automatically."