diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..b94e4d4
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,55 @@
+name: Release
+
+# Publishes to npm through Trusted Publishing: npm trusts this workflow file
+# via OIDC, so no token or one-time password is stored, and the package gets a
+# provenance statement.
+on:
+  release:
+    types: [published]
+  # For a version whose GitHub release already exists.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency: release
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint
+      - run: pnpm build
+      - run: pnpm typecheck
+      - run: pnpm test:unit
+
+      - name: Check the version
+        id: version
+        run: |
+          version=$(node -p "require('./package.json').version")
+          if [ "$GITHUB_EVENT_NAME" = release ] && [ "$GITHUB_REF_NAME" != "v$version" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $version"
+            exit 1
+          fi
+          if npm view "react-clear-browser-cache@$version" version >/dev/null 2>&1; then
+            echo "::error::react-clear-browser-cache@$version is already on npm"
+            exit 1
+          fi
+          # Prereleases must not become `latest`.
+          case "$version" in
+            *-*) echo "tag=next" >> "$GITHUB_OUTPUT" ;;
+            *) echo "tag=latest" >> "$GITHUB_OUTPUT" ;;
+          esac
+
+      # Trusted Publishing needs npm 11.5.1 or newer.
+      - run: npm install -g npm@^11.5.1
+      - run: npm publish --tag ${{ steps.version.outputs.tag }}
diff --git a/README.md b/README.md
index 1d24474..bfa785a 100644
--- a/README.md
+++ b/README.md
@@ -375,6 +375,10 @@ pnpm demo:dev      # the GitHub Pages demo, with deploys simulated in the browse
 
 The demo is the example app built with `VITE_DEMO=1`. GitHub Pages serves static files only, so a fetch shim answers `meta.json` with a version kept in localStorage; the version check, cache clearing and reload are the library's own. `.github/workflows/pages.yml` publishes it on every push to `master`.
 
+### Releasing
+
+Bump `version` in `package.json`, add the `CHANGELOG.md` entry, merge, then publish a GitHub release tagged `v<version>`. `.github/workflows/release.yml` checks, builds and publishes it to npm with provenance through Trusted Publishing.
+
 ## License
 
 [MIT](LICENSE) © Maksym Synenko