diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5e0e07c..48f3ec6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,9 @@ on:
 
 permissions: {}
 
+env:
+  REGISTRY: ghcr.io
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -21,6 +24,12 @@ jobs:
           version: '2.25.1'
           platform: 'linux64'
           checksum: '4f070e6cc7009e75aec307ed109c2fcf0501e579c20a31080b893e31209523d5'
+      - name: Log in to the Container registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - run: make test
       - run: make publish
         env:
diff --git a/README.md b/README.md
index e9d3edc..c9371dd 100644
--- a/README.md
+++ b/README.md
@@ -53,3 +53,13 @@ make pack-upgrade
 make test format
 make generate-table generate-help
 ```
+
+## Release
+
+1. Ensure all `qlpack.yml` files have the correct version.
+
+   ```shell
+   ./scripts/update-version.sh <version>
+   ```
+
+1. Create a release on GitHub, create a new tag, and autogenerate release notes.
diff --git a/go/src/qlpack.yml b/go/src/qlpack.yml
index fe2fb0e..be7ca7c 100644
--- a/go/src/qlpack.yml
+++ b/go/src/qlpack.yml
@@ -2,7 +2,7 @@
 name: trailofbits/go-queries
 description: CodeQL queries for Go developed by Trail of Bits
 authors: Trail of Bits
-version: 0.2.1
+version: 0.3.0
 license: AGPL
 library: false
 extractor: go
diff --git a/java/src/qlpack.yml b/java/src/qlpack.yml
index 0ec638e..e613be7 100644
--- a/java/src/qlpack.yml
+++ b/java/src/qlpack.yml
@@ -2,7 +2,7 @@
 name: trailofbits/java-queries
 description: CodeQL queries for Java developed by Trail of Bits
 authors: Trail of Bits
-version: 0.0.1
+version: 0.3.0
 license: AGPL
 library: false
 extractor: java-kotlin
diff --git a/scripts/update-version.sh b/scripts/update-version.sh
new file mode 100755
index 0000000..42c1dc6
--- /dev/null
+++ b/scripts/update-version.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+	echo "Usage: $0 <version>" >&2
+	echo "Example: $0 0.4.0" >&2
+	exit 1
+fi
+
+version="$1"
+
+if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+	echo "Error: version must be semver (X.Y.Z), got: $version" >&2
+	exit 1
+fi
+
+packs=(
+	cpp/lib/qlpack.yml
+	cpp/src/qlpack.yml
+	go/src/qlpack.yml
+	java/src/qlpack.yml
+)
+
+for f in "${packs[@]}"; do
+	if [[ ! -f "$f" ]]; then
+		echo "Error: file not found: $f (run from repo root)" >&2
+		exit 1
+	fi
+	if ! grep -q '^version: ' "$f"; then
+		echo "Error: no 'version:' line in $f" >&2
+		exit 1
+	fi
+done
+
+for f in "${packs[@]}"; do
+	tmp="$(mktemp)"
+	sed "s/^version: .*/version: $version/" "$f" >"$tmp"
+	mv "$tmp" "$f"
+	echo "Updated $f -> $version"
+done