diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..db3d8a20
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,74 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      contents: write
+      packages: write
+    env:
+      HUB_IMAGE: ghcr.io/corbitsdev/corbits-builder-hub
+      SIDECAR_IMAGE: ghcr.io/corbitsdev/corbits-builder-sidecar
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - id: version
+        run: |
+          version=$(jq -r .version package.json)
+          if [ "$GITHUB_REF_NAME" != "v$version" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $version"
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: hub
+          push: true
+          tags: ${{ env.HUB_IMAGE }}:${{ steps.version.outputs.version }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: sidecar
+          push: true
+          tags: ${{ env.SIDECAR_IMAGE }}:${{ steps.version.outputs.version }}
+      - env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          notes="$RUNNER_TEMP/notes.md"
+          cat > "$notes" <<EOF
+          Images:
+
+          - \`$HUB_IMAGE:$VERSION\`
+          - \`$SIDECAR_IMAGE:$VERSION\`
+
+          [docs/SELF_HOST.md](https://github.com/$GITHUB_REPOSITORY/blob/$GITHUB_REF_NAME/docs/SELF_HOST.md) covers self-hosting; set the hub and sidecar `image:` to these refs instead of building.
+          EOF
+          prerelease=()
+          if [[ "$VERSION" == 0.* || "$VERSION" == *-* ]]; then
+            prerelease=(--prerelease)
+          fi
+          gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --verify-tag \
+            --generate-notes --notes-file "$notes" "${prerelease[@]}"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6c40902a..23eabd7d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -139,6 +139,14 @@ change follows, whether a person or a coding agent writes it.
   `vendor/interchange.manifest.json`; `bun run vendor:verify` fails on
   anything unrecorded.
 
+## Releasing
+
+Maintainers bump `version` in the root, `apps/hub`, `apps/web`,
+`packages/client` and `packages/schemas` package.json files, run
+`bun install`, and merge. Then `git tag -s vX.Y.Z && git push origin vX.Y.Z`
+publishes the hub and sidecar images and the GitHub release; a 0.x version or
+one with a `-` suffix is marked a pre-release.
+
 ## Security
 
 Report vulnerabilities through [SECURITY.md](https://github.com/corbitsdev/corbits-builder/blob/main/SECURITY.md), never a public
diff --git a/apps/hub/package.json b/apps/hub/package.json
index c69102c1..aa3bcf3c 100644
--- a/apps/hub/package.json
+++ b/apps/hub/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@corbits-builder/hub",
-  "version": "0.0.0",
+  "version": "0.1.0-rc.1",
   "private": true,
   "license": "SEE LICENSE IN ../../LICENSE.md",
   "author": "Sawyer Cutler <sawyer@dirtroad.dev>",
diff --git a/apps/hub/src/app.ts b/apps/hub/src/app.ts
index 868e4828..53ff4293 100644
--- a/apps/hub/src/app.ts
+++ b/apps/hub/src/app.ts
@@ -101,6 +101,7 @@ import { requestErrorMetadata } from "./request-error.ts";
 import { createLiveAppProxy } from "./live-app/proxy.ts";
 import { createLiveAppRunner } from "./live-app/runner.ts";
 import { mountWebUi } from "./web-ui.ts";
+import { version } from "../package.json";
 
 const log = getLogger(["corbits-builder", "hub"]);
 
@@ -569,7 +570,7 @@ export async function createHubRuntime(
     );
     mountHubOpenAPI(app, {
       config,
-      version: "0.0.0",
+      version,
       securitySchemes: {
         sessionCookie: {
           type: "apiKey",
diff --git a/apps/web/package.json b/apps/web/package.json
index 71795438..8c144aa6 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@corbits-builder/web",
-  "version": "0.0.0",
+  "version": "0.1.0-rc.1",
   "private": true,
   "description": "Builder portal (Vite + React). Composes the hub's authenticated APIs.",
   "license": "SEE LICENSE IN ../../LICENSE.md",
diff --git a/bun.lock b/bun.lock
index 27c7656e..32764fd6 100644
--- a/bun.lock
+++ b/bun.lock
@@ -59,7 +59,7 @@
     },
     "apps/hub": {
       "name": "@corbits-builder/hub",
-      "version": "0.0.0",
+      "version": "0.1.0-rc.1",
       "dependencies": {
         "@anthropic-ai/sandbox-runtime": "0.0.81",
         "@corbits-builder/coder": "workspace:*",
@@ -115,7 +115,7 @@
     },
     "apps/web": {
       "name": "@corbits-builder/web",
-      "version": "0.0.0",
+      "version": "0.1.0-rc.1",
       "dependencies": {
         "@corbits-builder/client": "workspace:*",
         "@corbits-builder/schemas": "workspace:*",
@@ -146,7 +146,7 @@
     },
     "packages/client": {
       "name": "@corbits-builder/client",
-      "version": "0.0.0",
+      "version": "0.1.0-rc.1",
       "dependencies": {
         "@corbits-builder/schemas": "workspace:*",
         "arktype": "catalog:",
@@ -154,7 +154,7 @@
     },
     "packages/schemas": {
       "name": "@corbits-builder/schemas",
-      "version": "0.0.0",
+      "version": "0.1.0-rc.1",
       "dependencies": {
         "arktype": "catalog:",
       },
diff --git a/package.json b/package.json
index 1d97dbf7..74d7c5b9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "corbits-builder",
-  "version": "0.0.0",
+  "version": "0.1.0-rc.1",
   "private": true,
   "description": "Builder turns an idea into approved documents, a design and a working web app, with agents on the model provider you choose.",
   "license": "SEE LICENSE IN LICENSE.md",
diff --git a/packages/client/package.json b/packages/client/package.json
index f29b4c52..b96a58d4 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@corbits-builder/client",
-  "version": "0.0.0",
+  "version": "0.1.0-rc.1",
   "private": true,
   "license": "SEE LICENSE IN ../../LICENSE.md",
   "author": "Sawyer Cutler <sawyer@dirtroad.dev>",
diff --git a/packages/schemas/package.json b/packages/schemas/package.json
index f6236375..a6299b7e 100644
--- a/packages/schemas/package.json
+++ b/packages/schemas/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@corbits-builder/schemas",
-  "version": "0.0.0",
+  "version": "0.1.0-rc.1",
   "private": true,
   "license": "SEE LICENSE IN ../../LICENSE.md",
   "author": "Sawyer Cutler <sawyer@dirtroad.dev>",