diff --git a/.github/workflows/android-sdk-ci.yml b/.github/workflows/android-sdk-ci.yml
index e03f825..bba8f1b 100644
--- a/.github/workflows/android-sdk-ci.yml
+++ b/.github/workflows/android-sdk-ci.yml
@@ -6,6 +6,7 @@ on:
     tags:
       - v[0-9]+.[0-9]+.[0-9]+
       - v[0-9]+.[0-9]+.[0-9]+-*
+  workflow_call:
 
 jobs:
   sdk-tests:
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
new file mode 100644
index 0000000..7e4e06d
--- /dev/null
+++ b/.github/workflows/tag.yml
@@ -0,0 +1,81 @@
+name: Tag release
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: "Which part of the version to increment"
+        type: choice
+        options:
+          - minor
+          - major
+          - patch
+        default: minor
+
+permissions:
+  contents: read
+
+jobs:
+  tag:
+    name: Tag master
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.next.outputs.version }}
+    steps:
+      - name: Refuse to release from anything but master
+        if: github.ref != 'refs/heads/master'
+        run: |
+          echo "::error::Release must run on master, got ${{ github.ref }}. Re-run and pick master."
+          exit 1
+
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Compute next version
+        id: next
+        env:
+          BUMP: ${{ inputs.bump }}
+        run: |
+          set -euo pipefail
+          latest=$(git tag -l | grep -E '^v?[0-9]+\.[0-9]+\.[0-9]+$' | sed 's/^v//' | sort -V | tail -n1 || true)
+          latest=${latest:-0.0.0}
+          IFS=. read -r major minor patch <<<"${latest}"
+          case "$BUMP" in
+            major) major=$((major + 1)); minor=0; patch=0 ;;
+            minor) minor=$((minor + 1)); patch=0 ;;
+            patch) patch=$((patch + 1)) ;;
+          esac
+          version="v${major}.${minor}.${patch}"
+          echo "${latest} -> ${version}"
+          echo "version=${version}" >>"$GITHUB_OUTPUT"
+          {
+            echo "### Release \`${version}\`"
+            echo ""
+            echo "Previous: \`${latest}\` · bump: \`${BUMP}\` · commit: \`${GITHUB_SHA:0:7}\`"
+          } >>"$GITHUB_STEP_SUMMARY"
+
+      - name: Create and push tag
+        env:
+          VERSION: ${{ steps.next.outputs.version }}
+        run: |
+          set -euo pipefail
+          for tag in "${VERSION}" "${VERSION#v}"; do
+            if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
+              echo "::error::${tag} already exists. Someone tagged out of band."
+              exit 1
+            fi
+          done
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${VERSION}" -m "Release ${VERSION}"
+          git push origin "${VERSION}"
+
+  ci:
+    # Tags pushed with GITHUB_TOKEN don't trigger other workflows, so CI is called directly.
+    name: CI
+    needs: tag
+    uses: ./.github/workflows/android-sdk-ci.yml