diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..3c270d95
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,80 @@
+name: Publish a Release
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version without leading "v" (1.0, 2.3.4, 0.1.0-pre1)'
+        required: true
+        default: ''
+      image_tags:
+        description: 'Extra docker image tags ("latest,test")'
+        required: true
+        default: 'latest,release'
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: write
+    steps:
+    - name: Ensure version does not start with 'v'
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ github.token }}
+        script: |
+          version = context.payload.inputs.version;
+          if (/^v/.test(version)) throw new Error("Bad version number: " + version)
+    - uses: actions/checkout@v4
+    - name: Cache data/sources
+      uses: ./.github/cache-sources-action
+    - uses: actions/setup-java@v4
+      with:
+        java-version: '21'
+        distribution: 'temurin'
+        cache: 'maven'
+
+    - name: Check tag does not exist yet
+      run: if git rev-list "v${{ github.event.inputs.version }}"; then echo "Tag already exists. Aborting the release process."; exit 1; fi
+
+    - run: ./scripts/set-versions.sh "${{ github.event.inputs.version }}"
+    - run: ./scripts/build-release.sh
+    - run: ./scripts/test-release.sh "${{ github.event.inputs.version }}"
+    - name: Create tag
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ github.token }}
+        script: |
+          github.rest.git.createRef({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            ref: "refs/tags/v${{ github.event.inputs.version }}",
+            sha: context.sha
+          })
+    - run: mv target/*with-deps.jar planetiler-openmaptiles.jar
+    - run: sha256sum planetiler-openmaptiles.jar > planetiler-openmaptiles.jar.sha256
+    - run: md5sum planetiler-openmaptiles.jar > planetiler-openmaptiles.jar.md5
+    - name: Create Release
+      uses: softprops/action-gh-release@v1
+      with:
+        fail_on_unmatched_files: true
+        tag_name: v${{ github.event.inputs.version }}
+        draft: true
+        files: |
+          planetiler-openmaptiles.jar*
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+    - name: 'Build and push to dockerhub'
+      run: ./mvnw -B -ntp -Pjib-multi-arch -Djib.to.tags="latest" package jib:build --file pom.xml
+    - run: sha256sum target/*with-deps.jar
+    - run: md5sum target/*with-deps.jar
+    - name: 'Upload artifact'
+      uses: actions/upload-artifact@v4
+      with:
+        name: planetiler-build
+        path: target/*with-deps.jar
diff --git a/scripts/build-release.sh b/scripts/build-release.sh
new file mode 100755
index 00000000..73fd8932
--- /dev/null
+++ b/scripts/build-release.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -eu
+
+./mvnw -B -ntp install jib:dockerBuild