diff --git a/.github/workflows/publish-tag.yml b/.github/workflows/publish-tag.yml
new file mode 100644
index 0000000..7b51929
--- /dev/null
+++ b/.github/workflows/publish-tag.yml
@@ -0,0 +1,101 @@
+name: Publish tag
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Git tag to publish (e.g. v0.2.3)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        ruby: ["3.4", "4.0"]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+          persist-credentials: false
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - run: bundle exec rspec
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    outputs:
+      gem_name: ${{ steps.build.outputs.gem_name }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+      - name: Verify tag matches gem version
+        run: |
+          GEM_VERSION=$(ruby -r ./lib/glyphs/version -e "puts Glyphs::VERSION")
+          TAG_VERSION="${{ inputs.tag }}"
+          TAG_VERSION="${TAG_VERSION#v}"
+          if [ "$GEM_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Tag version ($TAG_VERSION) does not match gem version ($GEM_VERSION)"
+            exit 1
+          fi
+      - name: Build gem
+        id: build
+        run: |
+          gem build glyphs.gemspec --strict
+          GEM_NAME=$(ls glyphs-*.gem)
+          echo "gem_name=$GEM_NAME" >> "$GITHUB_OUTPUT"
+          sha256sum "$GEM_NAME" > "$GEM_NAME.sha256"
+          sha512sum "$GEM_NAME" > "$GEM_NAME.sha512"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gem
+          path: |
+            glyphs-*.gem
+            glyphs-*.gem.sha256
+            glyphs-*.gem.sha512
+
+  publish-rubygems:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: rubygems
+    permissions:
+      id-token: write
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: gem
+      - name: Verify checksums
+        run: |
+          sha256sum -c glyphs-*.gem.sha256
+          sha512sum -c glyphs-*.gem.sha512
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+      - uses: rubygems/configure-rubygems-credentials@bc6dd217f8a4f919d6835fcfefd470ef821f5c44 # v1.0.0
+      - name: Push to RubyGems with Sigstore attestation
+        run: |
+          GEM_NAME=$(ls glyphs-*.gem)
+          VERSION="${GEM_NAME%.gem}"
+          VERSION="${VERSION#glyphs-}"
+          if gem info glyphs --exact --remote 2>/dev/null | grep -q "glyphs ($VERSION)"; then
+            echo "::warning::Version $VERSION already published to RubyGems, skipping push"
+          else
+            gem exec sigstore-cli sign "$GEM_NAME" \
+              --bundle "$GEM_NAME.sigstore.json"
+            gem push "$GEM_NAME" --attestation "$GEM_NAME.sigstore.json"
+          fi