diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5f1e7ab..125495b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,3 +58,51 @@ jobs:
 
       - name: Run staticcheck
         run: staticcheck ./...
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    needs: [test, staticcheck]
+    if: github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    permissions:
+      contents: write
+    concurrency:
+      group: release
+      cancel-in-progress: false
+    outputs:
+      tag: ${{ steps.release.outputs.tag }}
+      created: ${{ steps.release.outputs.created }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Tag and release the version in client.go
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="$(sed -nE 's/.*Version *= *"([^"]+)".*/\1/p' client.go | head -1)"
+          if [ -z "$VERSION" ]; then
+            echo "::error::Version not found in client.go"
+            exit 1
+          fi
+          TAG="v$VERSION"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+          STATUS=0
+          git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null || STATUS=$?
+          case "$STATUS" in
+            0)
+              echo "Tag $TAG already exists; nothing to release."
+              echo "created=false" >> "$GITHUB_OUTPUT"
+              ;;
+            2)
+              gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --generate-notes
+              echo "Created tag and release $TAG at $GITHUB_SHA."
+              echo "created=true" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "::error::git ls-remote failed with exit status $STATUS"
+              exit "$STATUS"
+              ;;
+          esac
diff --git a/README.md b/README.md
index 3f92790..57258ae 100644
--- a/README.md
+++ b/README.md
@@ -252,6 +252,16 @@ The `IP` struct includes all fields from the ipdata API response:
 
 **`Scores`** (`Threat.Scores`): `VPNScore`, `ProxyScore`, `ThreatScore`, `TrustScore`; each is a number from 0 to 100, and a higher `TrustScore` means a more trustworthy address
 
+## Releasing
+
+Releases are cut by CI from the `Version` constant in `client.go`. To publish
+a new version, bump `Version` in a pull request and merge it: the push to
+`master` runs the `release` job of the CI workflow, which tags the merge commit
+`vX.Y.Z` and creates the GitHub release for it with generated notes. Nothing
+else needs publishing: Go modules are fetched straight from the tag, so
+`go get github.com/ipdata/go@vX.Y.Z` works as soon as it exists. A merge whose
+`Version` is already tagged releases nothing.
+
 ## Contributors
 
 - [Tim Heckman](https://github.com/theckman/) - Created the first version of this library