diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 58cc043..9b26519 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,3 +93,19 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.REGISTRY_PAT }}
         continue-on-error: true
+      - name: Publish GitHub release
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.RELEASES_TOKEN || github.token }}
+          script: |
+            const tag = context.ref.replace('refs/tags/', '');
+            const { owner, repo } = context.repo;
+            const { data: release } = await github.rest.repos.getReleaseByTag({ owner, repo, tag });
+            if (release.draft) {
+              await github.rest.repos.updateRelease({
+                owner,
+                repo,
+                release_id: release.id,
+                draft: false,
+              });
+            }
diff --git a/.goreleaser.yml b/.goreleaser.yml
index c64a77c..9065708 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -32,3 +32,6 @@ checksum:
 
 changelog:
   sort: asc
+
+release:
+  draft: true