diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..1eb4370
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,66 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+      - 'v*.*.*-*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Publish GitHub release + SBOM
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: '8.4'
+          coverage: none
+
+      - name: Install runtime dependencies
+        run: composer install --no-dev --prefer-dist --no-interaction --no-progress
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+        with:
+          format: cyclonedx-json
+          output-file: lacommerce.cdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      # A release without a real description is incomplete, so the body comes from this
+      # version's CHANGELOG section rather than from generated notes alone.
+      - name: Extract this version's CHANGELOG section
+        id: changelog
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          body=$(awk -v v="$version" '
+            $0 ~ "^## \\[?" v "\\]?" { found = 1; next }
+            found && /^## / { exit }
+            found { print }
+          ' CHANGELOG.md)
+          {
+            echo 'body<<CHANGELOG_EOF'
+            echo "$body"
+            echo 'CHANGELOG_EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Publish release
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        with:
+          generate_release_notes: true
+          body: ${{ steps.changelog.outputs.body }}
+          files: lacommerce.cdx.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed3cc4f..3c5b76d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,8 +7,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-Preparing the first tagged release. An entry dated 2022-02-03 used to sit here as `0.1.0`, but no tag was
-ever cut for it and the package was never published.
+## [0.1.0] - 2026-10-05
+
+The first tagged release. An entry dated 2022-02-03 used to sit here as `0.1.0`, but no tag was ever
+cut for it and the package was never published.
 
 ### Added
 
@@ -40,3 +42,6 @@ ever cut for it and the package was never published.
 - The config was merged twice; it is merged once.
 - View, translation and asset loaders and publish tags pointed at directories the package does not ship;
   they are now registered only when the directory exists.
+
+[Unreleased]: https://github.com/simtabi/lacommerce/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/simtabi/lacommerce/releases/tag/v0.1.0