diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..f8a2fc6
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,37 @@
+name: Publish release artifacts and docs for new tags
+on:
+  push:
+    tags:
+      - "v*"
+jobs:
+  publish:
+    runs-on: gha-trusted
+    permissions:
+      contents: "write" # Required for publishing release artifacts
+      id-token: "write"
+    steps:
+      - uses: actions/checkout@v3
+      - id: auth
+        name: Authenticate to GCP
+        uses: google-github-actions/auth@v0.8.0
+        with:
+          create_credentials_file: "true"
+          workload_identity_provider: "projects/498345658902/locations/global/workloadIdentityPools/oidc-fed/providers/github-actions"
+          service_account: "github-artifact-deploy@monogon-infra.iam.gserviceaccount.com"
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@v0
+      - name: Install Cloud SDK alpha commands
+        run: gcloud --quiet components install alpha
+      - name: Build artifacts
+        run: bazel build -c opt //metropolis/node:bundle //metropolis/handbook //metropolis/cli/metroctl
+      - name: Attach artifacts to Release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            bazel-bin/metropolis/node/bundle.zip
+            bazel-bin/metropolis/cli/metroctl/metroctl_/metroctl
+      - name: Upload to GCS
+        run: |-
+          gcloud alpha storage cp bazel-bin/metropolis/node/bundle.zip gs://monogon-release-artifacts/${GITHUB_REF##*/}/bundle.zip
+          gcloud alpha storage cp bazel-bin/metropolis/cli/metroctl/metroctl_/metroctl gs://monogon-release-artifacts/${GITHUB_REF##*/}/metroctl
+          gcloud alpha storage cp -r bazel-bin/metropolis/handbook/handbook gs://monogon-release-artifacts/${GITHUB_REF##*/}/handbook