diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 91f7817..8424530 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -6,16 +6,8 @@ env:
   CARGO_INCREMENTAL: '1'
 'on':
   push:
-    branches:
-      - main
-    tags-ignore:
-      - '**'
-    paths-ignore:
-      - '**/*.md'
-      - LICENSE
-      - '**/*.gitignore'
-      - .editorconfig
-      - docs/**
+    tags:
+      - 'v*'
   pull_request: null
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -108,7 +100,7 @@ jobs:
       - name: Build oxrls CLI
         run: cargo build --release --bin oxrls
         shell: bash
-      - name: Upload artifact
+      - name: Upload NAPI artifact
         uses: actions/upload-artifact@v7
         with:
           name: bindings-${{ matrix.settings.target }}
@@ -116,6 +108,12 @@ jobs:
             ${{ env.APP_NAME }}.*.node
             ${{ env.APP_NAME }}.*.wasm
           if-no-files-found: error
+      - name: Upload oxrls binary
+        uses: actions/upload-artifact@v7
+        with:
+          name: oxrls-${{ matrix.settings.target }}
+          path: target/release/oxrls*
+          if-no-files-found: error
   test:
     name: cargo test - ${{ matrix.settings.target }}
     needs:
@@ -151,8 +149,6 @@ jobs:
           key: ${{ matrix.settings.target }}-test-${{ matrix.settings.host }}
       - name: Run tests
         run: cargo test
-
-  # Linux tests are covered by the `test` job above (ubuntu-latest)
   publish:
     name: Publish
     runs-on: ubuntu-latest
@@ -179,37 +175,33 @@ jobs:
           path: artifacts
       - name: Move artifacts
         run: yarn artifacts
-      - name: List packages
-        run: ls -R ./npm
-        shell: bash
-      - name: Publish
-          run: |
-            npm config set provenance true
-            COMMIT_MSG=$(git log -1 --pretty=%B)
-            if echo "$COMMIT_MSG" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z]+\.[0-9]+)?$'; then
-              echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-              if echo "$COMMIT_MSG" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
-                npm publish --access public
-              else
-                npm publish --tag next --access public
-              fi
+      - name: Determine version and tag
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          if echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z]+\.[0-9]+)?$'; then
+            if echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+              echo "NPM_TAG=latest" >> $GITHUB_ENV
             else
-              echo "Not a release, skipping publish"
+              echo "NPM_TAG=next" >> $GITHUB_ENV
             fi
-
-        run: |
-          npm config set provenance true
-          if git log -1 --pretty=%B | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+$";
-          then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --access public
-          elif git log -1 --pretty=%B | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+";
-          then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --tag next --access public
           else
-            echo "Not a release, skipping publish"
+            echo "NPM_TAG=latest" >> $GITHUB_ENV
           fi
+      - name: Publish to npm
+        run: |
+          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
+          npm publish --access public --tag ${{ env.NPM_TAG }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: v${{ env.VERSION }}
+          tag_name: ${{ github.ref_name }}
+          prerelease: ${{ env.NPM_TAG == 'next' }}
+          files: |
+            artifacts/oxrls-*/
+          generate_release_notes: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}