diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..a8817b0
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,26 @@
+name: release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  publish_pypi:
+    name: "Publish package on PyPI"
+    runs-on: ubuntu-20.04
+    if: github.ref == 'refs/heads/master' && github.repository == 'commaai/body-jim'
+    steps:
+    - uses: actions/checkout@v3
+    - uses: actions/setup-python@v2
+      with:
+        python-version: '3.11'
+    - name: Bump version and tag
+      run: |
+        git config --global user.name "Vehicle Researcher"
+        git config --global user.email "user@comma.ai"
+
+        bash scripts/bump_tag.sh
+
+        git push --no-verify --force-with-lease --tags origin master
+    - name: Build and publish
+      run: |
+        bash scripts/publish_pypi.sh "${{ secrets.PYPI_PAT }}"
diff --git a/scripts/bump_tag.sh b/scripts/bump_tag.sh
new file mode 100755
index 0000000..0f15c55
--- /dev/null
+++ b/scripts/bump_tag.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+BRANCH="$(git branch --show-current)"
+TOML_VERSION="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+LATEST_TAG_VERSION="$(git tag --list | sort -V -r | head -n 1)"
+TAGGED_VERSION=""
+
+if [[ "$BRANCH" != "master" ]]; then
+  echo "Not on master branch."
+  exit 1
+fi
+
+if [[ "$TOML_VERSION" == "$LATEST_TAG_VERSION" ]]; then
+  TAGGED_VERSION=$(echo "$TOML_VERSION" | python3 -c "v = input().split('.'); v[-1]=str(int(v[-1])+1); print('.'.join(v))")
+  sed -i "s/version = \"$TOML_VERSION\"/version = \"$TAGGED_VERSION\"/" pyproject.toml
+elif [[ -z "$LATEST_TAG_VERSION" ]] || printf "$LATEST_TAG_VERSION\n$TOML_VERSION" | sort -V -C; then
+  TAGGED_VERSION="$TOML_VERSION"
+else
+  echo "Version in pyproject.toml is lower than the latest tag version."
+  exit 1
+fi
+
+echo "Tagging $TAGGED_VERSION..."
+if [[ -n "$(git ls-files -m | grep pyproject.toml)" ]]; then
+  echo "Commiting pyproject.toml..."
+  git add pyproject.toml
+  git commit --no-verify -m "Bump version to $TAGGED_VERSION"
+fi
+git tag "$TAGGED_VERSION"
diff --git a/scripts/publish_pypi.sh b/scripts/publish_pypi.sh
new file mode 100755
index 0000000..1cb0563
--- /dev/null
+++ b/scripts/publish_pypi.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [[ -z "$1" ]]; then
+  echo "Usage: $0 <PyPI token>"
+  exit 1
+fi
+PYPI_TOKEN="$1"
+
+# install required packages
+pip install --upgrade twine build
+
+# build the package
+python3 -m build
+
+# upload to PyPI
+REPOSITORY=""
+if [[ -n "$TEST_UPLOAD" ]]; then
+    REPOSITORY="--repository testpypi"
+fi
+
+python3 -m twine upload $REPOSITORY --username __token__ --password "$PYPI_TOKEN" dist/*