diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9f05e7b..303d7c4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,10 +4,15 @@ on:
   push:
     branches:
       - master
+    tags:
+      - "v*"
   pull_request:
     branches:
       - master
 
+permissions:
+  contents: read
+
 env:
   PYICU_VERSION: "2.14"
   LIBICU_VERSION: "76"
@@ -87,7 +92,7 @@ jobs:
 
       - uses: actions/upload-artifact@v4
         with:
-          name: linux-${{ matrix.cpy }}-${{ matrix.platform }}_${{ matrix.arch }}
+          name: cibw-linux-${{ matrix.cpy }}-${{ matrix.platform }}_${{ matrix.arch }}
           path: ./wheelhouse/*.whl
 
   macos:
@@ -147,5 +152,29 @@ jobs:
 
       - uses: actions/upload-artifact@v4
         with:
-          name: macos-${{ matrix.macos }}-${{ matrix.cpy }}-macosx_${{ matrix.arch }}
+          name: cibw-macos-${{ matrix.macos }}-${{ matrix.cpy }}-macosx_${{ matrix.arch }}
           path: ./wheelhouse/*.whl
+
+  publish:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    name: Publish wheels
+    runs-on: ubuntu-latest
+    needs:
+      - linux
+      - macos
+    environment:
+      name: release
+      url: https://pypi.org/project/pyicu-wheels
+
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: cibw-*
+          path: dist
+          merge-multiple: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1