diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 69e84cbc..58ca601f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,7 +2,7 @@ name: Release
 
 on:
   push:
-    tags: '*'
+    tags: '*.*.*'
 
 env:
   CARGO_TERM_COLOR: always
@@ -126,3 +126,21 @@ jobs:
           asset_path: cpp/build/package/${{ steps.build-archive.outputs.filename }}
           asset_name: ${{ steps.build-archive.outputs.filename }}
           asset_content_type: application/x-7z-compressed
+
+  publish:
+    runs-on: ubuntu-24.04
+
+    environment: release
+
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+
+      - run: cargo publish -p libloot
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}