diff --git a/.github/scripts/create-release.js b/.github/scripts/create-release.js
new file mode 100644
index 00000000..f63d5b6e
--- /dev/null
+++ b/.github/scripts/create-release.js
@@ -0,0 +1,30 @@
+module.exports = async ({ github, context }) => {
+  const newTag = process.env.NEW_TAG;
+  const repository = process.env.REPOSITORY;
+
+  const { data } = await github.rest.repos.generateReleaseNotes({
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    tag_name: newTag,
+  });
+
+  const dockerInfo = `
+
+---
+  As with all our previous releases, you can find the Docker images:
+- [Backend](https://ghcr.io/${repository}/backend:${newTag})
+- [Ingester](https://ghcr.io/${repository}/ingester:${newTag})
+
+
+${data.body}`;
+
+  await github.rest.repos.createRelease({
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    tag_name: newTag,
+    name: data.name,
+    body: dockerInfo,
+    draft: true,
+    prerelease: false,
+  });
+};
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 25fd66b3..dc728b5f 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -2,6 +2,12 @@ name: Build and push docker images
 
 on:
   workflow_call:
+    inputs:
+      release-tag:
+        description: Release tag to add to images
+        required: false
+        type: string
+        default: ''
   workflow_dispatch:
 
 permissions:
@@ -42,6 +48,7 @@ jobs:
             type=ref,event=branch
             type=sha,format=short
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=${{ inputs.release-tag }},enable=${{ inputs.release-tag != '' }}
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..a6411d9d
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,75 @@
+name: Release Cairo Coder
+
+on:
+  workflow_dispatch:
+    inputs:
+      release-type:
+        description: Type of release
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+        default: minor
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  update-version:
+    runs-on: ubuntu-latest
+    outputs:
+      new-version: ${{ steps.version.outputs.new-version }}
+      new-tag: ${{ steps.version.outputs.new-tag }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Update version and create tag
+        id: version
+        run: |
+          npm version ${{ inputs.release-type }} --no-git-tag-version
+          NEW_VERSION=$(node -p "require('./package.json').version")
+
+          echo "new-version=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "new-tag=v$NEW_VERSION" >> $GITHUB_OUTPUT
+
+          echo "NEW_VERSION=$NEW_VERSION"
+          echo "NEW_TAG=v$NEW_VERSION"
+
+          git config --local user.email "${{ github.actor }}@users.noreply.github.com"
+          git config --local user.name "${{ github.actor }}"
+
+          git add package.json
+          git commit -m "release: v$NEW_VERSION"
+          git tag "v$NEW_VERSION"
+          git push origin HEAD --tags
+
+  build-new-image:
+    needs: update-version
+    uses: ./.github/workflows/publish-image.yml
+    with:
+      release-tag: ${{ needs.update-version.outputs.new-tag }}
+    secrets: inherit
+
+  create-release:
+    needs: [update-version, build-new-image]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Create draft release
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const script = require('./.github/scripts/create-release.js');
+            await script({ github, context });
+        env:
+          NEW_TAG: ${{ needs.update-version.outputs.new-tag }}
+          REPOSITORY: ${{ github.repository }}
diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 985a31fc..6250461b 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -18,7 +18,6 @@ runtimes:
 lint:
   enabled:
     - actionlint@1.7.7
-    - checkov@3.2.439
     - git-diff-check
     - hadolint@2.12.1-beta
     - markdownlint@0.45.0