diff --git a/.bcr/source.template.json b/.bcr/source.template.json
index 4f14819..902c238 100644
--- a/.bcr/source.template.json
+++ b/.bcr/source.template.json
@@ -1,5 +1,5 @@
 {
   "integrity": "",
   "strip_prefix": "{REPO}-{VERSION}",
-  "url": "https://github.com/{OWNER}/{REPO}/archive/refs/tags/{TAG}.tar.gz"
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{VERSION}.tar.gz"
 }
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..d522eff
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,48 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: 'Tag name for release (e.g. "v1.0.0")'
+        required: true
+
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+
+jobs:
+  create-release-tag:
+    name: Create release tag
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Create tag
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const tag = '${{ github.event.inputs.tag_name }}';
+            const commitTag = await github.rest.git.createTag({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              tag,
+              message: tag,
+              object: context.sha,
+              type: 'commit',
+            });
+            await github.rest.git.createRef({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: `refs/tags/${tag}`,
+              sha: commitTag.data.sha,
+            });
+  release:
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.3
+    needs: create-release-tag
+    with:
+      release_files: rules_buf-*.tar.gz
+      prerelease: false
+      draft: true
+      tag_name: ${{ github.event.inputs.tag_name }}
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
new file mode 100755
index 0000000..684c961
--- /dev/null
+++ b/.github/workflows/release_prep.sh
@@ -0,0 +1,72 @@
+#!/bin/bash
+set -x -e -u -o pipefail
+
+if [[ $# -ne 1 ]]; then
+    >&2 echo "Usage: ${0} <version tag>"
+    exit 1
+fi
+
+NAME="rules_buf"
+TAG="${1}"
+PREFIX="${NAME}-${TAG:1}"
+ARCHIVE="${PREFIX}.tar.gz"
+
+# Update MODULE.bazel version
+>&2 echo "# Update MODULE.bazel version to ${TAG:1}"
+if ! awk -v tag="${TAG:1}" '
+    sub(/version = "0\.0\.0",/, "version = \"" tag "\",") {
+        count++;
+    }
+    { print; }
+    END {
+        if (count != 1) {
+            exit 1;
+        }
+    }
+' MODULE.bazel > MODULE.bazel.tmp; then
+    >&2 echo "Failed to update MODULE.bazel version!"
+    rm MODULE.bazel.tmp
+    exit 1
+fi
+
+mv MODULE.bazel.tmp MODULE.bazel
+>&2 echo "MODULE.bazel contents:"
+>&2 cat MODULE.bazel
+
+# Create release archive
+>&2 echo "# Create release archive ${ARCHIVE}"
+>&2 git archive \
+    --prefix="${PREFIX}/" \
+    --output="${ARCHIVE}" \
+    "$(git stash create)"
+
+>&2 echo "Release archive ${ARCHIVE} contents:"
+>&2 tar tvf "${ARCHIVE}"
+
+# Calculate SHA256 sum for WORKSPACE code
+SHA256=$(shasum -a 256 "${ARCHIVE}" | awk '{print $1}')
+
+# Generate release notes snippets
+>&2 echo "# Generate release notes snippets"
+cat << EOF
+## \`MODULE.bazel\` Usage
+\`\`\`bzl
+bazel_dep(name = "rules_buf", version = "${TAG:1}")
+\`\`\`
+
+## \`WORKSPACE\` Usage
+\`\`\`bzl
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "rules_buf",
+    sha256 = "${SHA256}",
+    strip_prefix = "${PREFIX}",
+    urls = [
+        "https://github.com/bufbuild/rules_buf/releases/download/${TAG}/rules_buf-${TAG:1}.tar.gz",
+    ],
+)
+\`\`\`
+EOF
+
+>&2 echo "Success."
diff --git a/MODULE.bazel b/MODULE.bazel
index e8bb4e9..366b19a 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -16,7 +16,7 @@
 
 module(
     name = "rules_buf",
-    version = "0.4.0",
+    version = "0.0.0",
     compatibility_level = 1,
 )
 
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..1cb72ef
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,72 @@
+# Releasing rules_buf
+
+rules_buf contains a Bazel module with Bzlmod and WORKSPACE support which is
+pushed to the Bazel Central Repository. Proper release process is necessary to
+ensure that the Bzlmod module is published to the BCR properly.
+
+1.  **Run the [Release] workflow.**
+
+    Go to the [Release] workflow page and select <q>Run workflow</q>,
+    with the desired version tag (e.g. `v1.2.3`).
+
+    <details>
+
+    <summary>What this workflow does</summary>
+
+    This will create a release tag for the latest `main` revision, `v1.2.3`.
+
+    Note that this workflow creates tags directly on GitHub instead of pushing
+    tags up, so it will not indirectly trigger automations that trigger on tags.
+    The BCR release script is run as a workflow call. Creating the tags manually
+    will not trigger this.
+
+    </details>
+
+1.  **Find the draft release.**
+
+    Upon running the previous workflow, a release draft should be created.
+    Check for it in the [releases page].
+
+    If for some reason this doesn't happen, check the workflow log for more
+    information.
+
+    <details>
+
+    <summary>Manually creating a release draft</summary>
+
+    Note that manually-created releases will not pass attestation and can not
+    be pushed to the BCR.
+
+    To manually create a release draft, run `.github/workflows/release_prep.sh`
+    with the version tag (e.g. `vX.Y.Z`) as an argument, while checked out to
+    the release tag/commit:
+
+    ```
+    .github/workflows/release_prep.sh v1.2.3 >release_notes.md
+    ```
+
+    This will create two files:
+
+    - `release_notes.md`: This should be prepended to the GitHub-generated
+      release notes. It contains instructions on how to include the repo with
+      Bazel.
+    - `rules_buf-1.2.3.tar.gz`: This should be attached to the release. It
+      includes a stable tarball of the release commit for Bazel.
+
+    </details>
+
+1.  **Publish the release.**
+
+    Once the release draft is created, edit it as needed, prepending any
+    important notes (e.g. breaking changes), and finally, publish it.
+
+1.  **Check [Bazel Central Registry repository] for a pull request.**
+
+    Shortly after publishing the release, the [Publish to BCR] workflow should
+    create a new pull request. There may be failures in CI that need to be
+    addressed.
+
+[Release]: https://github.com/bufbuild/rules_buf/actions/workflows/release.yaml
+[releases page]: https://github.com/bufbuild/rules_buf/releases
+[Bazel Central Registry repository]: https://github.com/bazelbuild/bazel-central-registry/pulls
+[Publish to BCR]: https://github.com/bazel-contrib/publish-to-bcr