diff --git a/.github/workflows/oci-publish.yml b/.github/workflows/oci-publish.yml
index 7979d0fd..6fcde8a5 100644
--- a/.github/workflows/oci-publish.yml
+++ b/.github/workflows/oci-publish.yml
@@ -1,6 +1,9 @@
 name: Publish OCI image to ghcr.io
 
-on: workflow_dispatch
+on:
+  release:
+    types: [published]
+  workflow_dispatch: 
 
 permissions: {}
 
diff --git a/.github/workflows/release-winget.yml b/.github/workflows/release-winget.yml
new file mode 100644
index 00000000..2e2aa6c5
--- /dev/null
+++ b/.github/workflows/release-winget.yml
@@ -0,0 +1,26 @@
+name: Winget Release
+on:
+  # push:
+  #   tags:
+  #     - 'v*'   # run on any tag push like v8.14.3, v8.15.0 etc.
+  release:
+    types: [published]
+
+  # release:
+  #   types: [released]
+jobs:
+  publish:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout tag
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0          # fetch all history so tags are available
+          ref: ${{ github.event.release.tag_name }}  # this ensures we check out the pushed tag
+      - name: Winget Releaser
+        uses: vedantmgoyal9/winget-releaser@main
+        with:
+          identifier: libvips.libvips
+          installers-regex: 'w64\-all*\.zip $' 
+          token: ${{ secrets.WINGET_TOKEN }}
+          version: ${{ github.event.release.tag_name }} 
diff --git a/.github/workflows/sync-fork.yml b/.github/workflows/sync-fork.yml
new file mode 100644
index 00000000..7af53f3e
--- /dev/null
+++ b/.github/workflows/sync-fork.yml
@@ -0,0 +1,77 @@
+name: Sync winget-release-workflow fork branch with upstream master
+# Default branch set to winget-release-workflow rather than master so action can run, and changes only occur in that branch so master is synced. 
+
+on:
+  schedule:
+    - cron: '0 0 1 1 *'   # ~never run https://crontab.guru/#0_0_1_1_* 
+  workflow_dispatch:
+
+jobs:
+  sync-master:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout fork master
+        uses: actions/checkout@v4
+        with:
+          ref: master
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add upstream remote
+        run: |
+          git remote add upstream https://github.com/libvips/build-win64-mxe.git || true
+          git fetch upstream master --tags
+
+      - name: Hard reset fork master to upstream
+        run: |
+          git checkout master
+          git reset --hard upstream/master
+          git push origin master --force
+
+  sync-winget-branch:
+    runs-on: ubuntu-latest
+    needs: sync-master
+    steps:
+      - name: Checkout fork branch
+        uses: actions/checkout@v4
+        with:
+          ref: winget-release-workflow
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add upstream remote
+        run: |
+          git remote add upstream https://github.com/libvips/build-win64-mxe.git || true
+          git fetch upstream master --tags
+
+      - name: Configure Git identity
+        run: |
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "github-actions[bot]"
+
+      - name: Merge upstream/master into winget-release-workflow
+        # rebase would merge-conflict, and we want OCI to run onevery release
+        run: |
+          git checkout winget-release-workflow
+          git merge upstream/master --no-ff -m "Merge upstream/master into winget-release-workflow"
+          git push origin winget-release-workflow
+          
+      - name: Push latest upstream tag
+        run: |
+          # find latest tag by commit date
+          LATEST_TAG=$(git describe --tags `git rev-list --tags --max-count=1`)
+          echo "Latest upstream tag: $LATEST_TAG"
+          echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_ENV
+          # check if tag exists in fork
+          if ! git ls-remote --tags origin | grep -q "refs/tags/$LATEST_TAG"; then
+            git push origin $LATEST_TAG
+            echo "Pushed latest tag to fork: $LATEST_TAG"
+          else
+            echo "Tag already exists in fork: $LATEST_TAG"
+          fi
+          
+      - name: Create GitHub release for latest tag
+        uses: ncipollo/release-action@v1
+        if: github.event_name == 'workflow_dispatch' || steps.push_tag.outputs.pushed == 'true' || !github.event_name
+        with:
+          tag: ${{ env.LATEST_TAG }}
+          generateReleaseNotes: true
+          skipIfReleaseExists: true