diff --git a/.github/workflows/add_tag.yml b/.github/workflows/add_tag.yml
new file mode 100644
index 0000000..a4025b5
--- /dev/null
+++ b/.github/workflows/add_tag.yml
@@ -0,0 +1,44 @@
+name: Add version tag
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Extract version
+        id: version
+        run: |
+          VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          echo "value=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Create tag if new version
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const tag = `v${{ steps.version.outputs.value }}`;
+            try {
+              await github.rest.git.getRef({ owner: context.repo.owner, repo: context.repo.repo, ref: `tags/${tag}` });
+              core.info(`Tag ${tag} already exists, skipping`);
+            } catch (e) {
+              if (e.status === 404) {
+                await github.rest.git.createRef({ owner: context.repo.owner, repo: context.repo.repo, ref: `refs/tags/${tag}`, sha: context.sha });
+                core.info(`Created tag ${tag}`);
+              } else { throw e; }
+            }
diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml
index 63f995f..0a3bfff 100644
--- a/.github/workflows/appinspect.yml
+++ b/.github/workflows/appinspect.yml
@@ -4,7 +4,8 @@ on:
   push:
     branches:
       - main
-      - release
+    tags:
+      - "v*"
   pull_request:
     branches:
       - main
@@ -27,11 +28,11 @@ jobs:
       - name: Run AppInspect
         uses: splunk/appinspect-cli-action@v2
         with:
-          app_path: 'build/copycat.tgz'
+          app_path: build/copycat.tgz
 
       - name: Upload app as artifact
-        if: github.event_name == 'push' && github.ref == 'refs/heads/release'
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: actions/upload-artifact@v7
         with:
-          path: 'build/copycat.tgz'
+          path: build/copycat.tgz
           compression-level: 0
diff --git a/release.sh b/release.sh
deleted file mode 100755
index b8f0c37..0000000
--- a/release.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/bash
-
-set -e
-
-git checkout release
-git merge main --ff-only
-git push origin release