diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e2800a..31878cd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
 
   build-ubuntu:
     needs: [build_stencils]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
 
     strategy:
       matrix:
@@ -144,3 +144,49 @@ jobs:
       with:
         name: runner-win
         path: bin/*
+
+  release-stencils:
+    needs: [build_stencils, build-ubuntu, build-windows]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          sparse-checkout: |
+            pyproject.toml
+            tools/get_tag.sh
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: tmp
+
+      - name: Get version tag name
+        id: version
+        run: bash tools/get_tag.sh
+
+      - name: Release stencils
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -v
+          mkdir -p release
+          cp tmp/stencil-object-files/*.o release/
+          cp tmp/runner-linux/coparun release/
+          cp tmp/runner-win/coparun.exe release/
+
+          TAG="${{ steps.version.outputs.version }}"
+
+          if ! gh release view "$TAG" &>/dev/null; then
+            echo "Creating new stencil release $TAG"
+            gh release create "$TAG" release/* \
+              --prerelease \
+              --title "$TAG" \
+              --notes "Automated release stencil for $TAG"
+          else
+            echo "Updating existing release for $TAG"
+            gh release upload "$TAG" release/* --clobber
+          fi
\ No newline at end of file
diff --git a/tools/build_container/Dockerfile b/tools/build_container/Dockerfile
index 5a255a7..d186276 100644
--- a/tools/build_container/Dockerfile
+++ b/tools/build_container/Dockerfile
@@ -11,4 +11,5 @@ RUN apt-get update && apt-get install -y \
     gcc-13-riscv64-linux-gnu \
     gcc-13-aarch64-linux-gnu \
     gcc-13-multilib \
-    python3
+    python3 \
+    git
diff --git a/tools/get_tag.sh b/tools/get_tag.sh
new file mode 100644
index 0000000..76f060c
--- /dev/null
+++ b/tools/get_tag.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Check if this run was triggered by a tag
+if [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then
+    TAG_NAME="${GITHUB_REF#refs/tags/}"
+    echo "Detected tag push: $TAG_NAME"
+    # For GitHub Actions output
+    echo "version=$TAG_NAME" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+    exit 0
+fi
+
+# Otherwise, extract version from pyproject.toml
+if [[ -f pyproject.toml ]]; then
+    VERSION=$(grep -E '^version\s*=' pyproject.toml \
+              | sed -E 's/version\s*=\s*"([^"]+)"/\1/' \
+              | tr -d '\r\n')
+    if [[ -z "$VERSION" ]]; then
+        echo "! Could not find version in pyproject.toml" >&2
+        exit 1
+    fi
+    echo "Detected version from pyproject.toml: v$VERSION-beta"
+    echo "version=v$VERSION-beta" >> "${GITHUB_OUTPUT:-/dev/stdout}"
+else
+    echo "! pyproject.toml not found" >&2
+    exit 1
+fi