diff --git a/.ci/scripts/release.sh b/.ci/scripts/release.sh
new file mode 100755
index 00000000..b31163e6
--- /dev/null
+++ b/.ci/scripts/release.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -eu -o pipefail
+
+BRANCH=$(git branch --show-current)
+
+if ! [[ "${BRANCH}" =~ ^RELEASE-[0-9]+\.[0-9]+$ ]]
+then
+  echo ERROR: This is not a release branch!
+  exit 1
+fi
+
+NEW_VERSION="$(bump-my-version show new_version --increment release)"
+echo "Release ${NEW_VERSION}"
+
+if ! [[ "RELEASE-${NEW_VERSION}" == "${BRANCH}"* ]]
+then
+  echo ERROR: Version does not match release branch
+  exit 1
+fi
+
+bump-my-version bump release --commit --message "Release {new_version}" --tag --tag-name "v{new_version}" --tag-message "Release {new_version}"
+bump-my-version bump patch --commit
+
+git push origin "${BRANCH}" "v${NEW_VERSION}"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..87dacd44
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,28 @@
+---
+name: "Publish Release"
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+jobs:
+  publish:
+    runs-on: "ubuntu-latest"
+    if: "github.repository == 'pulp/squeezer'"
+    steps:
+      - uses: "actions/checkout@v4"
+      - name: "Set up Python"
+        uses: "actions/setup-python@v5"
+        with:
+          python-version: "3.13"
+      - name: "Install Ansible"
+        run: |
+          pip install --upgrade ansible
+      - name: "Build Ansible Collection"
+        run: |
+          make dist
+      - name: "Publish Ansible Collection"
+        run: |
+          make publish GALAXY_API_KEY=${{ secrets.GALAXY_API_KEY }}
+...
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 22c7e56a..a3637a55 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,28 +1,30 @@
 ---
-name: "Release"
+name: "Tag Release"
 
 on:
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
 
 jobs:
   release:
-    runs-on: "ubuntu-20.04"
-    if: "github.repository == 'pulp/squeezer'"
+    name: "Release"
+    runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v4"
+        with:
+          token: "${{ secrets.RELEASE_TOKEN }}"
       - name: "Set up Python"
         uses: "actions/setup-python@v5"
         with:
-          python-version: "3.10"
-      - name: "Install Ansible"
+          python-version: "3.13"
+      - name: "Install dependencies"
         run: |
-          pip install --upgrade ansible
-      - name: "Build Ansible Collection"
+          python -m pip install --upgrade pip
+          pip install bump-my-version~=0.29.0
+      - name: "Setup git"
         run: |
-          make dist
-      - name: "Deploy Ansible Collection"
+          git config user.name pulpbot
+          git config user.email pulp-infra@redhat.com
+      - name: "Release"
         run: |
-          make publish GALAXY_API_KEY=${{ secrets.GALAXY_API_KEY }}
+          .ci/scripts/release.sh
 ...