diff --git a/.github/workflows/trybot.yaml b/.github/workflows/trybot.yaml
index 35a662e..33cbd4d 100644
--- a/.github/workflows/trybot.yaml
+++ b/.github/workflows/trybot.yaml
@@ -3,6 +3,8 @@
 name: TryBot
 "on":
   push:
+    tags:
+      - v*
     branches:
       - ci/test
       - master
@@ -140,3 +142,13 @@ jobs:
       - if: always()
         name: Check that git is clean at the end of the job
         run: test -z "$(git status --porcelain)" || (git status; git diff; false)
+      - working-directory: extension
+        if: github.repository == 'cue-lang/vscode-cue' && (startsWith(github.ref, 'refs/tags/v'))
+        name: Check version match
+        run: cue cmd -t tag=${GITHUB_REF##refs/tags/} checkReleaseVersion
+      - working-directory: extension
+        if: github.repository == 'cue-lang/vscode-cue' && (startsWith(github.ref, 'refs/tags/v') || (github.ref == 'refs/heads/ci/test'))
+        name: Release package
+        run: npm run publish -- -p $VSCODE_PAT
+        env:
+          VSCODE_PAT: ${{ secrets.CUECKOO_VSCODE_PAT }}
diff --git a/extension/extension_tool.cue b/extension/extension_tool.cue
index d8e38ad..57478f5 100644
--- a/extension/extension_tool.cue
+++ b/extension/extension_tool.cue
@@ -5,6 +5,7 @@ import (
 	"list"
 	"strings"
 
+	"tool/cli"
 	"tool/exec"
 	"tool/file"
 )
@@ -65,3 +66,23 @@ command: writebackPackageJSON: {
 		contents: place.stdout
 	}
 }
+
+// checkReleaseVersion ensures that the extension-configured version (which is
+// not actually a true semver version) corresponds to the string "argument"
+// passed via the attribute named tag are equal. We use a rather unpleasant
+// hack to force a failure because cue cmd has no such primitive.
+command: checkReleaseVersion: {
+	_version: string @tag(tag)
+
+	let commitVersion = "v" + extension.npm.version
+
+	if commitVersion != _version {
+		msg: cli.Print & {
+			text: "commitVersion \(commitVersion) != tag version \(_version)"
+		}
+		error: exec.Run & {
+			$after: msg
+			cmd:    "false"
+		}
+	}
+}
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index 8f25209..77c0208 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -27,6 +27,7 @@ workflows: trybot: _repo.bashWorkflow & {
 
 	on: {
 		push: {
+			tags: [_repo.releaseTagPattern]
 			branches: list.Concat([[_repo.testDefaultBranch], _repo.protectedBranchPatterns]) // do not run PR branches
 		}
 		pull_request: {}
@@ -78,6 +79,12 @@ workflows: trybot: _repo.bashWorkflow & {
 		let extensionStep = {
 			"working-directory": "extension"
 		}
+		let releaseStep = extensionStep & {
+			if: "github.repository == '\(_repo.githubRepositoryPath)' && (\(_repo.isReleaseTag))"
+		}
+		let releaseOrTestDefaultStep = extensionStep & {
+			if: "github.repository == '\(_repo.githubRepositoryPath)' && (\(_repo.isReleaseTag) || \(_repo.isTestDefaultBranch))"
+		}
 
 		steps: [
 			for v in _repo.checkoutCode {v},
@@ -141,10 +148,26 @@ workflows: trybot: _repo.bashWorkflow & {
 
 			// Final checks
 			_repo.checkGitClean,
+
+			// Release steps
+			releaseStep & {
+				name: "Check version match"
+				run:  "cue cmd -t tag=\(_versionRef) checkReleaseVersion"
+			},
+			releaseOrTestDefaultStep & {
+				name: "Release package"
+				run:  "npm run publish -- -p $VSCODE_PAT"
+				env: VSCODE_PAT: "${{ secrets.CUECKOO_VSCODE_PAT }}"
+			},
+
 		]
 	}
 }
 
+// _versionRef is a workflow job-runtime expression that evaluates to the git
+// tag (version) that is being released
+_versionRef: "${GITHUB_REF##refs/tags/}"
+
 _installNode: githubactions.#Step & {
 	name: "Install Node"
 	uses: "actions/setup-node@v4"