diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..55e3937
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,44 @@
+name: Release CLI
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Clean templates
+        run: make clean-templates
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: '~> v2'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index a49b07c..0e18536 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -58,26 +58,45 @@ A typical workflow we encounter is updating the API and integrating those change
 
 ### Releasing a new version
 
-Prerequisites:
+Releases are automated via GitHub Actions. Simply push a version tag and the release workflow will handle the rest.
 
-- Make sure you have **goreleaser-pro** installed via `brew install --cask goreleaser/tap/goreleaser-pro`. You will need a license key (in 1pw), and then `export GORELEASER_KEY=<the key>`. **Note: goreleaser-pro is required, not the standard goreleaser version.**
+#### To release:
 
-- Grab the NPM token for our org (in 1pw) and run `npm config set '//registry.npmjs.org/:_authToken'=<the token>`
+```bash
+# Find the latest version
+git describe --abbrev=0
 
-- export a `GITHUB_TOKEN` with repo and write:packages permissions: https://github.com/settings/tokens/new?scopes=repo,write:packages.
+# Create and push a new tag (bump version following https://semver.org/)
+git tag -a v<VERSION> -m "Version <VERSION>"
+git push origin v<VERSION>
+```
 
-With a clean tree on the branch you want to release (can be main or a pr branch you're about to merge, doesn't matter), run:
+The release workflow will automatically:
+- Build binaries for darwin, linux, and windows (amd64 and arm64)
+- Create a GitHub release with changelog
+- Publish to npm as `@onkernel/cli`
+- Update the Homebrew formula in `onkernel/homebrew-tap`
 
-```bash
-make release-dry-run
-```
+#### Required GitHub Secrets
 
-This will check that everything is working, but not actually release anything.
-You should see one error about there not being a git tag, and that's fine.
+The following secrets must be configured in the repository settings:
 
-To actually release, run:
+| Secret | Description |
+|--------|-------------|
+| `GH_PAT` | GitHub Personal Access Token with `repo` scope. Must have write access to both this repository (for creating releases) and `onkernel/homebrew-tap` (for updating the Homebrew formula). Create at https://github.com/settings/tokens/new?scopes=repo |
+| `GORELEASER_KEY` | GoReleaser Pro license key (required for npm and homebrew publishing) |
+| `NPM_TOKEN` | npm access token for publishing `@onkernel/cli` |
+
+#### Local dry-run (optional)
+
+To test the release process locally before pushing a tag:
+
+Prerequisites:
+- Install **goreleaser-pro** via `brew install --cask goreleaser/tap/goreleaser-pro`
+- Export `GORELEASER_KEY=<license key from 1pw>`
 
 ```bash
-# use `git describe --abbrev=0` to find the latest version and then bump it following https://semver.org/
-./scripts/release.sh <version> [description]
+make release-dry-run
 ```
+
+This will check that everything is working without actually releasing anything.
diff --git a/scripts/release.sh b/scripts/release.sh
deleted file mode 100755
index d970d01..0000000
--- a/scripts/release.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/bash
-
-set -e
-
-if [ -z "$1" ]; then
-    echo "Error: VERSION is required"
-    echo "Usage: $0 <VERSION> [DESCRIPTION]"
-    exit 1
-fi
-
-VERSION=$1
-if [[ ! "$VERSION" =~ ^[0-9.]+$ ]]; then
-    echo "Error: VERSION must contain only numbers and periods"
-    echo "Usage: $0 <VERSION> [DESCRIPTION]"
-    exit 1
-fi
-DESCRIPTION=${2:-"Version $VERSION"}
-
-git tag -a v$VERSION -m "$DESCRIPTION"
-git push origin v$VERSION
-make release
\ No newline at end of file