diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..0aa5267
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,23 @@
+name: Push gem
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    environment: release
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ruby
+          bundler-cache: true
+      - uses: rubygems/release-gem@v1
diff --git a/README.md b/README.md
index 789fff9..c75ef56 100644
--- a/README.md
+++ b/README.md
@@ -196,6 +196,11 @@ The smoke suite covers Client end-to-end against WebMock-stubbed OpenCode
 endpoints, including subscription-before-prompt ordering and
 reconnect-without-repost.
 
+Releases use RubyGems trusted publishing. After the repository's
+`release.yml` workflow is registered as a trusted publisher with the `release`
+environment, pushing a `v*` tag builds, attests, and publishes the gem without
+a long-lived RubyGems API key.
+
 ## License
 
 MIT. See [LICENSE](LICENSE).