diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..9b3602f
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,51 @@
+name: Release
+# On every merge to master, auto-compute the next version from git tags and
+# cut a GitHub release with a prebuilt npm tarball attached. Consumers install
+# expost from that release asset URL (no token, no install-time tsc build).
+# No version field to hand-edit — the tag is derived, not stored. See
+# beeminder/blog#656.
+on:
+  push:
+    branches: [master]
+permissions:
+  contents: write
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+env:
+  PNPM_VERSION: 9
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - run: git fetch --prune --tags
+      - id: semver
+        uses: ietf-tools/semver-action@v1
+        with:
+          token: ${{ github.token }}
+          branch: master
+          fallbackTag: v1.0.0
+          noVersionBumpBehavior: patch # release on every merge, not just conventional commits
+          skipInvalidTags: true
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
+      - name: Pack tarball named for the release tag
+        env:
+          VERSION: ${{ steps.semver.outputs.next }}
+        run: |
+          pnpm pack # respects files:[dist]; produces expost-<package.json version>.tgz
+          mv expost-*.tgz "expost-${VERSION#v}.tgz"
+      - name: Create release with tarball
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.semver.outputs.next }}
+        run: gh release create "$VERSION" "expost-${VERSION#v}.tgz" --title "$VERSION" --generate-notes
diff --git a/eslint.config.js b/eslint.config.js
index 7f221a8..0260d5f 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -4,7 +4,7 @@ import parser from "@typescript-eslint/parser";
 
 export default tseslint.config(
   {
-    ignores: ["node_modules", "dist"],
+    ignores: ["node_modules", "dist", "etherpad"],
   },
   eslint.configs.recommended,
   ...tseslint.configs.recommended,
diff --git a/package.json b/package.json
index 46de563..dbec856 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,7 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
+  "files": ["dist"],
   "scripts": {
     "test": "vitest",
     "lint": "eslint .",