diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
new file mode 100644
index 0000000000000..f300dbd27df59
--- /dev/null
+++ b/.github/workflows/tag-release.yml
@@ -0,0 +1,45 @@
+# Tag release and update changelog
+name: Tag release and update Changelog
+
+on:
+  workflow_dispatch:
+    inputs:
+      release-sha:
+        required: true
+        type: string
+
+jobs:
+    create-release:
+      runs-on: ubuntu-latest
+      steps:
+        - name: Checkout repo
+          uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        # Updates changelog and writes the release version into the environment
+        - name: Update Changelog
+          run: python3 tools/maint/create_release.py --action
+        - name: Create Changelog PR
+          uses: peter-evans/create-pull-request@v6
+          with:
+            title: Mark ${{ env.RELEASE_VERSION }} as released
+            delete-branch: true
+        - name: Tag release sha
+          uses: actions/github-script@v7
+          with:
+            github-token: ${{ secrets.EMSCRIPTEN_BOT_TOKEN }}
+            script: |
+              const tag_sha = '${{ inputs.release-sha }}';
+              const release_version = '${{ env.RELEASE_VERSION }}';
+              console.log(`Version ${release_version} at SHA ${tag_sha}`);
+              const regex = /^[0-9]+.[0-9]+.[0-9]+$/;
+              const match = release_version.match(regex);
+              if (!match) {
+                throw new Error('Malformed release version');
+              }
+              console.log(context.repo.owner);
+              console.log(context.repo.repo);
+              await github.rest.git.createRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `refs/tags/${release_version}`,
+                sha: tag_sha
+              });
diff --git a/ChangeLog.md b/ChangeLog.md
index 2b625630451d9..40acb6d0a657f 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -18,9 +18,12 @@ to browse the changes between the tags.
 
 See docs/process.md for more on how version tagging works.
 
-3.1.66 (in development)
+3.1.67 (in development)
 -----------------------
 
+3.1.66 - 08/30/24
+-----------------
+
 3.1.65 - 08/22/24
 -----------------
 - A new `--emit-minification-map` command line flag was added, which can be used
diff --git a/emcc.py b/emcc.py
index d02adb34d3784..d28d76239956b 100644
--- a/emcc.py
+++ b/emcc.py
@@ -45,7 +45,7 @@
 from tools import config
 from tools import cache
 from tools.settings import default_setting, user_settings, settings, MEM_SIZE_SETTINGS, COMPILE_TIME_SETTINGS
-from tools.utils import read_file, removeprefix
+from tools.utils import read_file, removeprefix, EMSCRIPTEN_VERSION
 
 logger = logging.getLogger('emcc')
 
@@ -569,7 +569,7 @@ def run(args):
     return 0
 
   if '-dumpversion' in args: # gcc's doc states "Print the compiler version [...] and don't do anything else."
-    print(shared.EMSCRIPTEN_VERSION)
+    print(utils.EMSCRIPTEN_VERSION)
     return 0
 
   if '--cflags' in args:
@@ -1099,7 +1099,7 @@ def version_string():
   elif os.path.exists(utils.path_from_root('emscripten-revision.txt')):
     rev = read_file(utils.path_from_root('emscripten-revision.txt')).strip()
     revision_suffix = ' (%s)' % rev
-  return f'emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) {shared.EMSCRIPTEN_VERSION}{revision_suffix}'
+  return f'emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) {utils.EMSCRIPTEN_VERSION}{revision_suffix}'
 
 
 def parse_args(newargs):
diff --git a/emscripten-version.txt b/emscripten-version.txt
index 54e0b4eb46b6d..05e89e2e2c672 100644
--- a/emscripten-version.txt
+++ b/emscripten-version.txt
@@ -1 +1 @@
-3.1.66-git
+3.1.67-git
diff --git a/test/test_core.py b/test/test_core.py
index 896f3c27eddad..4ddf04b74f4db 100644
--- a/test/test_core.py
+++ b/test/test_core.py
@@ -19,7 +19,7 @@
 
 from tools.shared import PIPE
 from tools.shared import EMCC, EMAR, FILE_PACKAGER
-from tools.utils import WINDOWS, MACOS, write_file, delete_file
+from tools.utils import WINDOWS, MACOS, write_file, delete_file, EMSCRIPTEN_VERSION
 from tools import shared, building, config, webassembly
 import common
 from common import RunnerCore, path_from_root, requires_native_clang, test_file, create_file
@@ -1802,7 +1802,7 @@ def test_emscripten_get_compiler_setting(self):
     self.do_runf(src, 'You must build with -sRETAIN_COMPILER_SETTINGS', assert_returncode=NON_ZERO)
     self.clear_setting('ASSERTIONS')
     self.set_setting('RETAIN_COMPILER_SETTINGS')
-    self.do_runf(src, read_file(output).replace('waka', shared.EMSCRIPTEN_VERSION))
+    self.do_runf(src, read_file(output).replace('waka', EMSCRIPTEN_VERSION))
 
   def test_emscripten_has_asyncify(self):
     src = r'''
diff --git a/test/test_other.py b/test/test_other.py
index ecf1315053f31..99c5cf6a61c7c 100644
--- a/test/test_other.py
+++ b/test/test_other.py
@@ -484,7 +484,7 @@ def test_emcc_basics(self, compiler, suffix):
 
     # -dumpversion
     output = self.run_process([compiler, '-dumpversion'], stdout=PIPE, stderr=PIPE)
-    self.assertEqual(shared.EMSCRIPTEN_VERSION, output.stdout.strip())
+    self.assertEqual(utils.EMSCRIPTEN_VERSION, output.stdout.strip())
 
     # properly report source code errors, and stop there
     self.clear()
@@ -5765,7 +5765,7 @@ def test_emversion(self):
 major: %d
 minor: %d
 tiny: %d
-''' % (shared.EMSCRIPTEN_VERSION_MAJOR, shared.EMSCRIPTEN_VERSION_MINOR, shared.EMSCRIPTEN_VERSION_TINY)
+''' % (utils.EMSCRIPTEN_VERSION_MAJOR, utils.EMSCRIPTEN_VERSION_MINOR, utils.EMSCRIPTEN_VERSION_TINY)
     self.do_runf('src.c', expected)
     self.do_runf('src.c', expected, emcc_args=['-sSTRICT'])
 
@@ -5845,7 +5845,7 @@ def test_dashE(self):
     def test(args):
       print(args)
       out = self.run_process([EMXX, 'src.cpp', '-E'] + args, stdout=PIPE).stdout
-      self.assertContained('%d %d %d __attribute__((used))' % (shared.EMSCRIPTEN_VERSION_MAJOR, shared.EMSCRIPTEN_VERSION_MINOR, shared.EMSCRIPTEN_VERSION_TINY), out)
+      self.assertContained('%d %d %d __attribute__((used))' % (utils.EMSCRIPTEN_VERSION_MAJOR, utils.EMSCRIPTEN_VERSION_MINOR, utils.EMSCRIPTEN_VERSION_TINY), out)
 
     test([])
     test(['-lembind'])
diff --git a/tools/link.py b/tools/link.py
index 2b6ec30226ce9..f895e6d5dc8cd 100644
--- a/tools/link.py
+++ b/tools/link.py
@@ -1757,7 +1757,7 @@ def get_full_import_name(name):
                                   'emscripten_stack_get_base',
                                   'emscripten_stack_get_end']
 
-  settings.EMSCRIPTEN_VERSION = shared.EMSCRIPTEN_VERSION
+  settings.EMSCRIPTEN_VERSION = utils.EMSCRIPTEN_VERSION
   settings.SOURCE_MAP_BASE = options.source_map_base or ''
 
   settings.LINK_AS_CXX = (shared.run_via_emxx or settings.DEFAULT_TO_CXX) and '-nostdlib++' not in newargs
diff --git a/tools/maint/create_release.py b/tools/maint/create_release.py
index 11f57038b6874..a1ddc05958253 100755
--- a/tools/maint/create_release.py
+++ b/tools/maint/create_release.py
@@ -13,18 +13,20 @@
 root_dir = os.path.dirname(os.path.dirname(script_dir))
 
 sys.path.insert(0, root_dir)
-from tools import shared, utils
+from tools import utils
 
 
-def main():
+def main(argv):
   if subprocess.check_output(['git', 'status', '-uno', '--porcelain'], cwd=root_dir).strip():
     print('tree is not clean')
     return 1
 
-  shared.set_version_globals()
+  is_github_runner = len(argv) > 1 and argv[1] == '--action'
 
-  release_version = [shared.EMSCRIPTEN_VERSION_MAJOR, shared.EMSCRIPTEN_VERSION_MINOR,
-                     shared.EMSCRIPTEN_VERSION_TINY]
+  utils.set_version_globals()
+
+  release_version = [utils.EMSCRIPTEN_VERSION_MAJOR, utils.EMSCRIPTEN_VERSION_MINOR,
+                     utils.EMSCRIPTEN_VERSION_TINY]
   new_dev_version = list(release_version)
   new_dev_version[2] += 1
 
@@ -58,20 +60,24 @@ def main():
 
   branch_name = 'version_' + release_version
 
-  # Create a new git branch
-  subprocess.check_call(['git', 'checkout', '-b', branch_name, 'upstream/main'], cwd=root_dir)
+  if is_github_runner: # For GitHub Actions workflows
+    with open(os.environ['GITHUB_ENV'], 'a') as f:
+      f.write(f'RELEASE_VERSION={release_version}')
+  else: # Local use
+    # Create a new git branch
+    subprocess.check_call(['git', 'checkout', '-b', branch_name, 'upstream/main'], cwd=root_dir)
 
-  # Create auto-generated changes to the new git branch
-  subprocess.check_call(['git', 'add', '-u', '.'], cwd=root_dir)
-  subprocess.check_call(['git', 'commit', '-m', f'Mark {release_version} as released'], cwd=root_dir)
-  print('New release created in branch: `%s`' % branch_name)
+    # Create auto-generated changes to the new git branch
+    subprocess.check_call(['git', 'add', '-u', '.'], cwd=root_dir)
+    subprocess.check_call(['git', 'commit', '-m', f'Mark {release_version} as released'], cwd=root_dir)
+    print('New release created in branch: `%s`' % branch_name)
 
-  # Push new branch to upstream
-  subprocess.check_call(['git', 'push', 'upstream', branch_name], cwd=root_dir)
+    # Push new branch to upstream
+    subprocess.check_call(['git', 'push', 'upstream', branch_name], cwd=root_dir)
 
   # TODO(sbc): Maybe create the tag too
   return 0
 
 
 if __name__ == '__main__':
-  sys.exit(main())
+  sys.exit(main(sys.argv))
diff --git a/tools/shared.py b/tools/shared.py
index 1d2224d19f02f..60fa92e01c4cb 100644
--- a/tools/shared.py
+++ b/tools/shared.py
@@ -40,7 +40,7 @@
 logging.basicConfig(format='%(name)s:%(levelname)s: %(message)s', level=log_level)
 colored_logger.enable()
 
-from .utils import path_from_root, exit_with_error, safe_ensure_dirs, WINDOWS
+from .utils import path_from_root, exit_with_error, safe_ensure_dirs, WINDOWS, set_version_globals
 from . import cache, tempfiles
 from . import diagnostics
 from . import config
@@ -424,16 +424,8 @@ def check_node():
     exit_with_error('the configured node executable (%s) does not seem to work, check the paths in %s (%s)', config.NODE_JS, config.EM_CONFIG, str(e))
 
 
-def set_version_globals():
-  global EMSCRIPTEN_VERSION, EMSCRIPTEN_VERSION_MAJOR, EMSCRIPTEN_VERSION_MINOR, EMSCRIPTEN_VERSION_TINY
-  filename = path_from_root('emscripten-version.txt')
-  EMSCRIPTEN_VERSION = utils.read_file(filename).strip().strip('"')
-  parts = [int(x) for x in EMSCRIPTEN_VERSION.split('-')[0].split('.')]
-  EMSCRIPTEN_VERSION_MAJOR, EMSCRIPTEN_VERSION_MINOR, EMSCRIPTEN_VERSION_TINY = parts
-
-
 def generate_sanity():
-  return f'{EMSCRIPTEN_VERSION}|{config.LLVM_ROOT}\n'
+  return f'{utils.EMSCRIPTEN_VERSION}|{config.LLVM_ROOT}\n'
 
 
 @memoize
diff --git a/tools/system_libs.py b/tools/system_libs.py
index 49dcd81172bfd..8cb1df9f888d3 100644
--- a/tools/system_libs.py
+++ b/tools/system_libs.py
@@ -2483,9 +2483,9 @@ def install_system_headers(stamp):
   version_file = cache.get_include_dir('emscripten/version.h')
   utils.write_file(version_file, textwrap.dedent(f'''\
   /* Automatically generated by tools/system_libs.py */
-  #define __EMSCRIPTEN_major__ {shared.EMSCRIPTEN_VERSION_MAJOR}
-  #define __EMSCRIPTEN_minor__ {shared.EMSCRIPTEN_VERSION_MINOR}
-  #define __EMSCRIPTEN_tiny__ {shared.EMSCRIPTEN_VERSION_TINY}
+  #define __EMSCRIPTEN_major__ {utils.EMSCRIPTEN_VERSION_MAJOR}
+  #define __EMSCRIPTEN_minor__ {utils.EMSCRIPTEN_VERSION_MINOR}
+  #define __EMSCRIPTEN_tiny__ {utils.EMSCRIPTEN_VERSION_TINY}
   '''))
 
   # Create a stamp file that signal that the headers have been installed
diff --git a/tools/utils.py b/tools/utils.py
index 539e519a53932..ea154d749daf4 100644
--- a/tools/utils.py
+++ b/tools/utils.py
@@ -108,3 +108,11 @@ def delete_contents(dirname, exclude=None):
       delete_dir(entry)
     else:
       delete_file(entry)
+
+
+def set_version_globals():
+  global EMSCRIPTEN_VERSION, EMSCRIPTEN_VERSION_MAJOR, EMSCRIPTEN_VERSION_MINOR, EMSCRIPTEN_VERSION_TINY
+  filename = path_from_root('emscripten-version.txt')
+  EMSCRIPTEN_VERSION = read_file(filename).strip().strip('"')
+  parts = [int(x) for x in EMSCRIPTEN_VERSION.split('-')[0].split('.')]
+  EMSCRIPTEN_VERSION_MAJOR, EMSCRIPTEN_VERSION_MINOR, EMSCRIPTEN_VERSION_TINY = parts