diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 000000000..10c3d8897
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,37 @@
+# Cut a release whenever a new tag is pushed to the repo.
+# You should use an annotated tag, like `git tag -a v1.2.3`
+# and put the release notes into the commit message for the tag.
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  tests:
+    # Do only release when CI succeeds.
+    uses: ./.github/workflows/workflow.yaml
+
+  release:
+    # Do only release when CI succeeds.
+    needs: [test-nixpkgs, test-examples]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Prepare release notes and artifacts
+        run: .github/workflows/release_prep.sh ${{ env.GITHUB_REF_NAME }} > release_notes.txt
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        with:
+          draft: true
+          prerelease: true
+          # Use GH feature to populate the changelog automatically
+          generate_release_notes: true
+          body_path: release_notes.txt
+          fail_on_unmatched_files: true
+          files: rules_nixpkgs*-*.tar.gz
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
new file mode 100755
index 000000000..ce70b8135
--- /dev/null
+++ b/.github/workflows/release_prep.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Set by GH actions, see
+# https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+TAG=${GITHUB_REF_NAME}
+# The prefix is chosen to match what GitHub generates for source archives
+PREFIX="rules_nixpkgs-${TAG:1}"
+ARCHIVE="rules_nixpkgs-${TAG:1}.tar.gz"
+git archive --format=tar.gz --prefix="${PREFIX}/" -o $ARCHIVE ${TAG}
+SHA=$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')
+
+cat << EOF
+## Using Bzlmod with Bazel 6
+
+1. Enable with \`common --enable_bzlmod\` in \`.bazelrc\`.
+2. Add to your \`MODULE.bazel\` file:
+
+\`\`\`starlark
+bazel_dep(name = "rules_nixpkgs_core", version = "${TAG:1}")
+\`\`\`
+
+## Using WORKSPACE
+
+Paste this snippet into your `WORKSPACE.bazel` file:
+
+\`\`\`starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_archive(
+    name = "rules_nixpkgs",
+    sha256 = "${SHA}",
+    strip_prefix = "${PREFIX}",
+    url = "https://github.com/myorg/rules_nixpkgs/releases/download/${TAG}/${ARCHIVE}",
+)
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "io_tweag_rules_nixpkgs",
+    strip_prefix = "$PREFIX",
+    urls = ["https://github.com/tweag/rules_nixpkgs/releases/download/$TAG/$ARCHIVE"],
+)
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:repositories.bzl", "rules_nixpkgs_dependencies")
+
+rules_nixpkgs_dependencies()
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_git_repository", "nixpkgs_package", "nixpkgs_cc_configure")
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:toolchains/go.bzl", "nixpkgs_go_configure") # optional
+\`\`\`
+EOF