diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a396e30..3c17ed7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,15 +14,19 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
   publish:
     name: Publish NuGet package
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     environment:
       name: release
       deployment: false
+    outputs:
+      package_version: ${{ steps.package.outputs.package_version }}
 
     steps:
       - name: Ensure main branch
@@ -89,6 +93,7 @@ jobs:
           tests/PackageSmoke/run.sh artifacts/packages "$package_version" net8.0 8.0.100
 
           printf 'package_file=%s\n' "$package_file" >> "$GITHUB_OUTPUT"
+          printf 'package_version=%s\n' "$package_version" >> "$GITHUB_OUTPUT"
 
       - name: Upload package artifacts
         uses: actions/upload-artifact@v7
@@ -111,3 +116,67 @@ jobs:
           --api-key "${{ steps.login.outputs.NUGET_API_KEY }}"
           --source https://api.nuget.org/v3/index.json
           --skip-duplicate
+
+  create-release:
+    name: Create GitHub release
+    runs-on: ubuntu-latest
+    needs: publish
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Create GitHub release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PACKAGE_VERSION: ${{ needs.publish.outputs.package_version }}
+        run: |
+          set -euo pipefail
+
+          tag="v${PACKAGE_VERSION}"
+          notes_file="$RUNNER_TEMP/release-notes.md"
+
+          awk -v version="$PACKAGE_VERSION" '
+            $0 == "## " version || index($0, "## " version " ") == 1 {
+              in_section = 1
+              next
+            }
+
+            in_section && /^## / {
+              exit
+            }
+
+            in_section {
+              print
+            }
+          ' CHANGELOG.md > "$notes_file"
+
+          if ! grep -q '[^[:space:]]' "$notes_file"; then
+            printf 'Could not find changelog notes for version %s.\n' "$PACKAGE_VERSION" >&2
+            exit 1
+          fi
+
+          git fetch --tags --force origin
+
+          if gh release view "$tag" >/dev/null 2>&1; then
+            printf 'GitHub release %s already exists.\n' "$tag"
+            exit 0
+          fi
+
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            tagged_commit="$(git rev-list -n 1 "$tag")"
+            if [ "$tagged_commit" != "$GITHUB_SHA" ]; then
+              printf 'Tag %s already points to %s, expected %s.\n' "$tag" "$tagged_commit" "$GITHUB_SHA" >&2
+              exit 1
+            fi
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git tag -a "$tag" -m "Release $tag" "$GITHUB_SHA"
+            git push origin "refs/tags/$tag"
+          fi
+
+          gh release create "$tag" --title "$tag" --notes-file "$notes_file" --verify-tag