diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d175be7f4..1cd1376ae 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -522,7 +522,8 @@ jobs:
       - name: Build
         working-directory: src
         run: |
-          make ${{ env.bindir }}/version.txt \
+          make REPOURL=${{ github.server_url }}/${{ github.repository }} \
+               ${{ env.bindir }}/version.txt \
                ${{ env.bindir }}/relname.txt \
                ${{ env.bindir }}/reltitle.txt \
                ${{ env.bindir }}/relnotes.md
@@ -579,3 +580,43 @@ jobs:
         run: |
           gh workflow run build.yml -f run_id=${{ github.run_id }}
           echo "Results at ${{ env.workflow_url }}"
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    needs:
+      - bios
+      - sbi
+      - uefi
+      - sbsign
+      - linux
+      - shim
+      - combine
+      - netboot
+      - version
+    if: >-
+      startsWith ( github.ref, 'refs/tags/v' )
+    steps:
+
+      - name: Download
+        uses: actions/download-artifact@v7
+        with:
+          pattern: "{bin-combi,netboot,version}"
+
+      - name: Tag check
+        run: |
+          RELNAME=$(cat version/relname.txt)
+          if [ "${{ github.ref_name }}" != "${RELNAME}" ] ; then
+              echo "ERROR: Tag does not match release name ${RELNAME}" >&2
+              exit 1
+          fi
+
+      - name: Release
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" --verify-tag --draft \
+              --title "$(cat version/relname.txt)" \
+              --notes-file version/relnotes.md \
+              bin-combi/ipxe.iso bin-combi/ipxe.usb netboot/ipxeboot.tar.gz