diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..fc6c568
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,58 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the GitHub Release
+      id-token: write # required for npm provenance
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # release notes need history
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - run: npm ci
+
+      # prepublishOnly runs these too, but running them here fails the job
+      # before anything is published rather than midway through.
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm test
+      - run: npm run build
+
+      # A tag that disagrees with package.json would publish the wrong
+      # version under the right tag name, which cannot be undone.
+      - name: Verify the tag matches package.json
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg="$(node -p "require('./package.json').version")"
+          if [ "$tag" != "$pkg" ]; then
+            echo "::error::tag v$tag does not match package.json version $pkg"
+            exit 1
+          fi
+
+      - run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create the GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release create "$GITHUB_REF_NAME" --generate-notes --verify-tag
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..3aeaaee
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,45 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## Unreleased
+
+### Fixed
+
+- Support the image editor `dock` and `corners` options in `Features` ([#25](https://github.com/unlayer/react-image-editor/issues/25))
+
+### Changed
+
+- Use the modern JSX transform
+
+### Internal
+
+- Full (100%) test coverage and additional edge-case scenarios
+
+## 1.0.2
+
+### Fixed
+
+- Contain exceptions thrown by a consumer's `onLoad` callback, so they can no longer surface as a wrapper failure ([#22](https://github.com/unlayer/react-image-editor/pull/22))
+
+### Added
+
+- Demo: image upload, so the demo can be tried with your own images
+
+## 1.0.1
+
+### Fixed
+
+- Contain exceptions thrown by a consumer's `onError` callback, which previously escaped as an unhandled promise rejection ([#9](https://github.com/unlayer/react-image-editor/issues/9))
+- Demo: auto-install demo dependencies in the root `dev` script, so a fresh clone works without a second `npm install` ([#8](https://github.com/unlayer/react-image-editor/issues/8))
+
+### Added
+
+- Demo: dark chrome for the top bar and sidebar
+
+## 1.0.0
+
+Initial release: the Unlayer Image Editor as a React component.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 701755e..db547f8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -24,6 +24,19 @@
 - `npm run build` builds the component for publishing to npm.
 - `npm run build` in the `demo` directory builds the demo app.
 
+## Releasing
+
+Releases are published from CI, not from a maintainer's machine.
+
+1. Update `CHANGELOG.md`: rename `Unreleased` to the new version.
+2. Bump the version: `npm version <patch|minor|major>` (this creates the `vX.Y.Z` tag).
+3. `git push --follow-tags`.
+
+Pushing the tag runs `.github/workflows/release.yml`, which re-runs lint,
+typecheck, tests and build, verifies the tag matches `package.json`, publishes
+to npm with [provenance](https://docs.npmjs.com/generating-provenance-statements),
+and creates the GitHub Release. It needs an `NPM_TOKEN` repository secret.
+
 ## Conventions
 
 - Commit messages follow [Conventional Commits 1.0](https://www.conventionalcommits.org/en/v1.0.0/).