diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..7474c67
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,65 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions: {}
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Stage npm package and create GitHub release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Validate release version
+        run: |
+          package_version="$(node -p "require('./package.json').version")"
+          if [[ "$GITHUB_REF_NAME" != "v$package_version" ]]; then
+            echo "Tag $GITHUB_REF_NAME does not match package.json version $package_version" >&2
+            exit 1
+          fi
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          version: 9
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+      - name: Setup npm
+        run: npm install --global npm@11.15.0
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Check formatting
+        run: pnpm run format:check
+      - name: Build
+        run: pnpm run build
+      - name: Integration test
+        run: pnpm run test:integration
+      - name: Stage npm package
+        run: |
+          if [[ "$GITHUB_REF_NAME" == *-* ]]; then
+            npm stage publish --provenance --access public --tag next
+          else
+            npm stage publish --provenance --access public
+          fi
+      - name: Create draft GitHub release
+        run: gh release create "$GITHUB_REF_NAME" --draft --generate-notes --verify-tag
+        env:
+          GH_TOKEN: ${{ github.token }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4392493..3811e8d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,4 +1,4 @@
-# Contributing
+# Development and Maintenance
 
 ## Local Development
 
@@ -29,3 +29,32 @@ pnpm run format:check
 ```
 
 tsdown bundles the plugin and its runtime dependencies into `dist/index.js`. Do not edit generated files in `dist/` by hand.
+
+## Releasing
+
+1. From a clean, up-to-date `main` branch, bump the version and push the resulting commit and tag:
+
+   ```bash
+   pnpm version 1.2.3
+   git push origin main --follow-tags
+   ```
+
+   `pnpm version` updates `package.json`, creates a version commit, and tags it as `v1.2.3`. The release workflow verifies the version, builds and tests the package, stages it on npm with provenance, and creates a draft GitHub release.
+
+2. Review the staged package on npmjs.com or with the npm CLI:
+
+   ```bash
+   npm stage list @langfuse/opencode-observability-plugin
+   npm stage view <stage-id>
+   npm stage download <stage-id>
+   ```
+
+3. Approve the staged package using an npm account with publish access and 2FA enabled:
+
+   ```bash
+   npm stage approve <stage-id>
+   ```
+
+4. Review and publish the draft GitHub release created by the workflow.
+
+Do not approve the npm package or publish the GitHub draft until both staged artifacts have been reviewed. If the workflow fails before staging, fix the problem and move the tag to the corrected release commit. If staging succeeded, do not rerun the workflow with the same version; staged and published versions cannot be staged again.
diff --git a/src/version.ts b/src/version.ts
index fd5681d..f290ccb 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1,2 +1,3 @@
-// TODO: Infer this from package.json at build time.
-export const PLUGIN_VERSION = "0.1.0";
+declare const __PLUGIN_VERSION__: string;
+
+export const PLUGIN_VERSION = __PLUGIN_VERSION__;
diff --git a/tsdown.config.ts b/tsdown.config.ts
index 34da0b2..3265510 100644
--- a/tsdown.config.ts
+++ b/tsdown.config.ts
@@ -1,7 +1,12 @@
 import { defineConfig } from "tsdown";
 
+import packageJson from "./package.json" with { type: "json" };
+
 export default defineConfig({
   entry: ["src/index.ts"],
+  define: {
+    __PLUGIN_VERSION__: JSON.stringify(packageJson.version),
+  },
   format: ["esm"],
   platform: "node",
   dts: false,