diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 395ce26d..0d1ad409 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,7 +15,7 @@ jobs:
     outputs:
       version: ${{ steps.build.version.outputs.version }}
     permissions:
-      contents: read
+      contents: write
       packages: write
 
     steps:
@@ -38,6 +38,15 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Bump version and push tag
+        # only run on push to main
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        id: tag
+        uses: mathieudutour/github-tag-action@v6.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          release_branches: main
+
       - name: Get commit hash
         id: hash
         run: echo "hash=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT