diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..734dac2
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,85 @@
+name: Release
+
+# Publishes Cimon.Net to NuGet and creates a GitHub release.
+#
+# Runs when a version tag (for example v2.0.0) is pushed, or by hand from the Actions tab
+# ("Run workflow") for a tag that already exists.
+#
+# Uses NuGet Trusted Publishing, so no long-lived API key is stored. It needs
+#   - a Trusted Publishing policy on nuget.org for archofthings/Cimon.Net and this file (release.yml)
+#   - a repository secret named NUGET_USER holding the nuget.org profile name (not the email address)
+on:
+  push:
+    tags: [ 'v*' ]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to release, for example v2.0.0'
+        required: true
+
+permissions:
+  contents: write   # create the GitHub release
+  id-token: write   # let NuGet/login exchange a GitHub OIDC token for a short-lived NuGet API key
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ inputs.tag || github.ref_name }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: refs/tags/${{ env.TAG }}
+
+      - uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: |
+            8.0.x
+            10.0.x
+
+      - name: Check the tag matches the package version
+        id: version
+        run: |
+          version=$(grep -oP '(?<=<Version>)[^<]+' src/CimonPlc/CimonPlc.csproj)
+          if [ "v$version" != "$TAG" ]; then
+            echo "Tag $TAG does not match package version $version" >&2
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Test
+        run: dotnet test --configuration Release
+
+      - name: Pack
+        run: dotnet pack src/CimonPlc/CimonPlc.csproj --configuration Release --output artifacts
+
+      - name: Extract release notes from CHANGELOG.md
+        run: |
+          awk -v version="${{ steps.version.outputs.version }}" '
+            $0 == "## " version { found = 1; next }
+            found && /^## / { exit }
+            found { print }
+          ' CHANGELOG.md > release-notes.md
+          if [ ! -s release-notes.md ]; then
+            echo "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/main/CHANGELOG.md)." > release-notes.md
+          fi
+          cat release-notes.md
+
+      - name: Log in to NuGet (Trusted Publishing)
+        id: nuget-login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: Publish to NuGet
+        run: dotnet nuget push "artifacts/*.nupkg" --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
+
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ env.TAG }}
+          name: Cimon.Net ${{ steps.version.outputs.version }}
+          body_path: release-notes.md
+          files: |
+            artifacts/*.nupkg
+            artifacts/*.snupkg