diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..d563180
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,41 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  package:
+    name: Build and inspect package
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'pytest-dev'
+    permissions:
+      id-token: write  # For build provenance attestation.
+      attestations: write
+
+    steps:
+      - uses: actions/checkout@v5
+      - name: Build package and attest build provenance
+        uses: hynek/build-and-inspect-python-package@v3
+        with:
+          attest-build-provenance-github: 'true'
+
+  publish:
+    name: Upload release to PyPI
+    needs: package
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'pytest-dev'
+    environment: release
+    permissions:
+      id-token: write  # For PyPI Trusted Publishing.
+
+    steps:
+      - name: Download package
+        uses: actions/download-artifact@v8
+        with:
+          name: Packages
+          path: dist
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
diff --git a/.github/workflows/main.yml b/.github/workflows/test.yml
similarity index 97%
rename from .github/workflows/main.yml
rename to .github/workflows/test.yml
index 866622f..26006da 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/test.yml
@@ -1,8 +1,7 @@
----
-name: build
+name: Test
 "on": [push, pull_request]
 jobs:
-  build:
+  test:
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
diff --git a/README.rst b/README.rst
index 02e5e8f..14c3286 100644
--- a/README.rst
+++ b/README.rst
@@ -10,7 +10,7 @@ pytest-timeout
 .. |anaconda| image:: https://img.shields.io/conda/vn/conda-forge/pytest-timeout.svg
   :target: https://anaconda.org/conda-forge/pytest-timeout
 
-.. |ci| image:: https://github.com/pytest-dev/pytest-timeout/workflows/build/badge.svg
+.. |ci| image:: https://github.com/pytest-dev/pytest-timeout/actions/workflows/test.yml/badge.svg
   :target: https://github.com/pytest-dev/pytest-timeout/actions
 
 .. |python| image:: https://img.shields.io/pypi/pyversions/pytest-timeout.svg
diff --git a/RELEASING.rst b/RELEASING.rst
new file mode 100644
index 0000000..eb352ac
--- /dev/null
+++ b/RELEASING.rst
@@ -0,0 +1,18 @@
+Releasing
+=========
+
+1. Update the version in ``setup.cfg``.
+2. Merge the PR to ``main``.
+3. Create a `GitHub Release <https://github.com/pytest-dev/pytest-timeout/releases/new>`_
+   with tag ``X.Y.Z`` targeting ``main``.
+4. The ``Release`` workflow builds the package, checks it, and publishes it
+   to PyPI.
+
+Notes for maintainers:
+
+- Publishing uses PyPI `Trusted Publishing
+  <https://docs.pypi.org/trusted-publishers/>`_ via the ``release``
+  environment: owner ``pytest-dev``, repo ``pytest-timeout``, workflow
+  ``release.yaml``, environment ``release``.
+- The ``release`` GitHub environment can require maintainer approval
+  before the publish job runs.