diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3cb688b..789ef11 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,13 +9,18 @@ on:
 jobs:
   tag:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v4
       - run: git tag ${{ github.event.inputs.version }} 
       - run: git push origin ${{ github.event.inputs.version }}
-
+      - uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ github.event.inputs.version }}
+          draft: true
 
   macos-aarch64:
     needs: tag
@@ -28,6 +33,10 @@ jobs:
         with:
           name: zup-macos-aarch64
           path: ./zig-out/bin/zup
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          artifacts: "zig-out/bin/zup"
 
   macos-x86_64:
     needs: tag
diff --git a/README.md b/README.md
index 54c9556..9e48628 100644
--- a/README.md
+++ b/README.md
@@ -129,3 +129,8 @@ for use during development under `/devserver`. This is currently a JS project,
 so it requires [Bun](https://bun.sh) installed. Run `bun install`, followed by 
 `bun run src/index.ts` to start up the mock server. Debug `zup` builds should
 automatically talk to this dev server. Release builds talk to Zig / ZLS servers.
+
+### Releases
+
+Running the `Release` GitHub action with a version number tags the `HEAD` on `main`
+and creates a pre-release. This must be published by a human manually.