diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..d9ba647
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,99 @@
+name: Ship Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump_type:
+        description: 'Type of version bump (major, minor, or patch)'
+        required: true
+        type: choice
+        default: 'minor'
+        options:
+          - major
+          - minor
+          - patch
+
+run-name: "Ship ${{ inputs.bump_type }} Release"
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  versions:
+    name: Set Version and Tag
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.bump_semver.outputs.version }}
+      tag: ${{ steps.bump_semver.outputs.tag }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref_name }}
+
+      - name: Get Latest Tag
+        id: get_latest_tag
+        run: |
+          version_prefix=${{ inputs.version_prefix }}
+          tag=$(git tag -l "v${version_prefix}.*" --sort=-v:refname | head -n 1)
+          tag=${tag:-v${version_prefix}.0.0}
+          echo "tag=${tag}" >> $GITHUB_OUTPUT
+          echo "🤔 *Previous tag: ${tag}*" >> $GITHUB_STEP_SUMMARY
+
+      - name: Set Version and Tag
+        id: bump_semver
+        run: |
+          set -e
+          tag="${{ steps.get_latest_tag.outputs.tag }}"
+          # Remove leading 'v'
+          version=${tag#v}
+          # Split into major, minor, and patch
+          IFS=. read -r major minor patch <<EOF
+          ${version}
+          EOF
+          # Increment version (defaults to minor)
+          case "${{ inputs.bump_type }}" in
+          patch) new_version="$major.$minor.$((patch+1))"; ;;
+          major) new_version="$((major+1)).0.0"; ;;
+          *)     new_version="$major.$((minor+1)).0"; ;;
+          esac
+          new_tag="v${new_version}"
+          echo "version=${new_version}" >> $GITHUB_OUTPUT
+          echo "tag=${new_tag}" >> $GITHUB_OUTPUT
+          echo "### 👷 Building ${new_version}" >> $GITHUB_STEP_SUMMARY
+
+      - name: Create and Push Tag
+        run: |
+          git config --global user.email "identity-uaa+ci@pivotal.io"
+          git config --global user.name "UAA Identity Bot"
+          git tag "${{ steps.bump_semver.outputs.tag }}"
+          git push origin "${{ steps.bump_semver.outputs.tag }}"
+          echo "🏷️ *Created and pushed tag: ${{ steps.bump_semver.outputs.tag }}*" >> $GITHUB_STEP_SUMMARY
+
+  releases-matrix:
+    name: Release Go Binary
+    runs-on: ubuntu-latest
+    needs: versions
+    strategy:
+      matrix:
+        # build and publish in parallel: linux/386, linux/amd64, linux/arm64, windows/386, windows/amd64, darwin/amd64, darwin/arm64
+        goos: [ linux, windows, darwin ]
+        goarch: [ "386", amd64, arm64 ]
+        exclude:
+          - goarch: "386"
+            goos: darwin
+          - goarch: arm64
+            goos: windows
+    steps:
+      - uses: actions/checkout@v4
+      - uses: wangyoucao577/go-release-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          goos: ${{ matrix.goos }}
+          goarch: ${{ matrix.goarch }}
+          build_command: "make"
+          build_flags: "build VERSION=${{ needs.versions.outputs.version }}"
+          binary_name: "build/uaa"
+          ldflags: "-I."