diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ee580c2..18355f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,9 +1,9 @@
 name: CI
 on:
-  push:
-    branches: [main]
   pull_request:
+  push:
     branches: [main]
+    tags: ["[0-9]+.[0-9]+.[0-9]+"]
 jobs:
   ci:
     strategy:
@@ -15,8 +15,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
@@ -25,6 +23,8 @@ jobs:
         uses: abatilo/actions-poetry@v2
         with:
           poetry-version: ${{ matrix.poetry-version }}
+      - name: Checkout repository
+        uses: actions/checkout@v4
       - name: Install dependencies
         run: poetry install --with dev
       - name: Configure environment
@@ -43,3 +43,29 @@ jobs:
       - name: Stop PostgreSQL container
         if: ${{ always() }}
         run: docker compose down --remove-orphans --volumes
+  publish:
+    name: Publish package to PyPI
+    if: github.event_name == 'push' && github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+    needs:
+      - ci
+    steps:
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.12"
+      - name: Set up Poetry
+        uses: abatilo/actions-poetry@v2
+        with:
+          poetry-version: "1.8.2"
+      - name: Add poetry dynamic versioning plugin
+        run: poetry self add poetry-dynamic-versioning
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Build wheel and sdist
+        run: poetry build
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1