diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7e2a16..6147bfe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,11 +37,11 @@ jobs:
           - os: windows-latest
             arch: x86
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         submodules: recursive
     - name: Set up Python 3.x
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: "3.x"
     - name: Install dependencies
@@ -50,7 +50,7 @@ jobs:
       run: python tests/download_test_data.py
     - name: Build and Test Wheels
       run: python -m cibuildwheel --output-dir wheelhouse
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       with:
         name: unicodedata2-${{ matrix.os }}-${{ matrix.arch }}
         path: wheelhouse/*.whl
@@ -68,52 +68,56 @@ jobs:
       id-token: write # IMPORTANT: mandatory for trusted publishing
       contents: write # Needed to create GH release
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         submodules: recursive
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: "3.x"
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install --upgrade build twine
-    - name: Download artifacts from build jobs
-      uses: actions/download-artifact@v4
-      with:
-        path: wheelhouse/
-    - name: Move wheels to dist/ directory
+        pip install --upgrade build
+    - name: Check the tag matches the package version
+      env:
+        TAG_NAME: ${{ github.ref_name }}
       run: |
-        ls wheelhouse/*
-        mkdir -p dist/
-        for wheel_dir in wheelhouse/unicodedata2*/; do
-          mv "${wheel_dir}"/*.whl dist/
-        done
+        VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+        if [ "$TAG_NAME" != "$VERSION" ]; then
+          echo "::error::tag '$TAG_NAME' does not match project version '$VERSION'"
+          exit 1
+        fi
+    - name: Download wheels from build jobs
+      uses: actions/download-artifact@v8
+      with:
+        merge-multiple: true
+        path: dist/
+    - name: Build sdist
+      run: python -m build --sdist
     - name: Extract release notes from annotated tag message
-      id: release_notes
+      env:
+        TAG_NAME: ${{ github.ref_name }}
       run: |
         # GH checkout action doesn't preserve tag annotations, we must fetch them
         # https://github.com/actions/checkout/issues/290
         git fetch --tags --force
-        # strip leading 'refs/tags/' to get the tag name
-        TAG_NAME="${GITHUB_REF##*/}"
-        # Dump tag message to temporary .md file (excluding the PGP signature at the bottom)
-        TAG_MESSAGE=$(git tag -l --format='%(contents)' $TAG_NAME | sed -n '/-----BEGIN PGP SIGNATURE-----/q;p')
-        echo "$TAG_MESSAGE" > "${{ runner.temp }}/release_notes.md"
+        # Dump tag message to a temporary .md file, minus any PGP signature
+        git tag -l --format='%(contents)' "$TAG_NAME" \
+          | sed -n '/-----BEGIN PGP SIGNATURE-----/q;p' \
+          > "${{ runner.temp }}/release_notes.md"
     - name: Create GitHub release
-      id: create_release
-      uses: actions/create-release@v1
       env:
         # This token is provided by Actions, you do not need to create your own token
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: ${{ github.ref }}
-        release_name: ${{ github.ref }}
-        body_path: "${{ runner.temp }}/release_notes.md"
-        draft: false
-        prerelease: false
-    - name: Build sdist
-      run: python -m build --sdist
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        TAG_NAME: ${{ github.ref_name }}
+      run: |
+        ls -l dist/
+        case "$TAG_NAME" in
+          *[ab][0-9]*|*rc[0-9]*|*dev[0-9]*) PRERELEASE=--prerelease ;;
+          *) PRERELEASE= ;;
+        esac
+        gh release create "$TAG_NAME" --title "$TAG_NAME" $PRERELEASE \
+          --notes-file "${{ runner.temp }}/release_notes.md"
     - name: Publish package distributions to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1