diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..d93d945
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,58 @@
+name: minisaml release workflow
+
+on:
+  release:
+    types: [released] # only triggered on release, not pre-release or draft release
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  PYTHON_VERSION: 3.12
+  TARGET_BRANCH: ${{ github.event.release.target_commitish }}
+  DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+  TAG_NAME: ${{ github.ref_name }}
+
+jobs:
+  release:
+    name: Release to PyPI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check whether release target branch is default branch
+        if: env.TARGET_BRANCH != env.DEFAULT_BRANCH
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.setFailed('Target branch (${{ env.TARGET_BRANCH }}) is not default branch (${{ env.DEFAULT_BRANCH }}).')
+      
+      - uses: actions/checkout@v4
+      
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          
+      - run: curl -sSL https://install.python-poetry.org | python3 -
+      
+      - run: echo "PKG_VER=$(poetry version --short)" >> $GITHUB_ENV
+      
+      - name: Check whether current tag matches package version
+        if: env.TAG_NAME != env.PKG_VER
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.setFailed('Tag name (${{ env.TAG_NAME }}) does not match package version (${{ env.PKG_VER }}).')
+      
+      - name: Build package
+        run: poetry build
+        
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1