diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 936c0271..d5ac5dc6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,27 +4,49 @@ on:
     tags:
       - v[0-9]+.[0-9]+.[0-9]+
       - v[0-9]+.[0-9]+.[0-9]+-*
+  workflow_call:
+    inputs:
+      version:
+        description: "Tag to release, e.g. v1.2.3"
+        required: true
+        type: string
 
 env:
   workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
   service-account: ${{ secrets.SERVICE_ACCOUNT }}
 
 jobs:
+  version:
+    runs-on: ubuntu-22.04
+    outputs:
+      version: ${{ steps.resolve.outputs.version }}
+    steps:
+      - name: Resolve version
+        id: resolve
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${INPUT_VERSION:-$REF_NAME}"
+          echo "Releasing ${version}"
+          echo "version=${version}" >>"$GITHUB_OUTPUT"
+
   tests-prettier:
     uses: ./.github/workflows/reusable-lint-test.yml
 
   build:
-    needs: [tests-prettier]
+    needs: [tests-prettier, version]
     uses: ./.github/workflows/reusable-build.yml
     permissions:
       contents: read
       id-token: write
     with:
-      version: ${{ github.ref_name }}
+      version: ${{ needs.version.outputs.version }}
 
   # This job needs to run before deploying to npm otherwise `latest` won't be updated
   define-gcs-versions-to-update:
-    needs: [build]
+    needs: [build, version]
     runs-on: ubuntu-22.04
 
     outputs:
@@ -49,7 +71,7 @@ jobs:
       - name: Determine versions to update
         id: sdk-versions
         env:
-          REF_NAME: ${{ github.ref_name }}
+          REF_NAME: ${{ needs.version.outputs.version }}
         run: ./scripts/versions-to-update.sh @optable/web-sdk "$REF_NAME" >> "$GITHUB_OUTPUT"
 
       - name: Show versions that will be updated
@@ -59,7 +81,7 @@ jobs:
           echo "SDK versions: $SDK_VERSIONS"
 
   deploy-sdk-to-npm:
-    needs: [build, define-gcs-versions-to-update]
+    needs: [build, define-gcs-versions-to-update, version]
     runs-on: ubuntu-22.04
     permissions:
       id-token: write
@@ -80,10 +102,10 @@ jobs:
           name: dist-lib
           path: lib/dist
 
-      # Step will fail if the version is invalid, github.ref_name is the tag name (v.*.*.*)
+      # Step will fail if the version is invalid (v.*.*.*)
       - name: Patch version
         env:
-          REF_NAME: ${{ github.ref_name }}
+          REF_NAME: ${{ needs.version.outputs.version }}
         run: ./scripts/patch-version.sh "$REF_NAME"
 
       - name: Setup pnpm
@@ -99,7 +121,7 @@ jobs:
         run: pnpm publish --provenance --access public --no-git-checks
 
   deploy-sdk-to-gcs:
-    needs: [deploy-sdk-to-npm, define-gcs-versions-to-update]
+    needs: [deploy-sdk-to-npm, define-gcs-versions-to-update, version]
     strategy:
       matrix:
         sdk-version: ${{ fromJSON(needs.define-gcs-versions-to-update.outputs.sdk-versions) }}
@@ -127,10 +149,10 @@ jobs:
           destination: "optable-web-sdk/${{ matrix.sdk-version }}"
           process_gcloudignore: false
           headers: |
-            x-goog-meta-optable-sdk-version: ${{ github.ref_name }}
+            x-goog-meta-optable-sdk-version: ${{ needs.version.outputs.version }}
 
   deploy-demo:
-    needs: [deploy-sdk-to-npm]
+    needs: [deploy-sdk-to-npm, version]
     permissions:
       contents: "read"
       id-token: "write"
@@ -172,7 +194,7 @@ jobs:
 
       - name: Build web-sdk-demos Docker Image
         env:
-          REF_NAME: ${{ github.ref_name }}
+          REF_NAME: ${{ needs.version.outputs.version }}
         run: |
           DOCKER_BUILDKIT=1 docker build \
             -t "us-docker.pkg.dev/optable-artifact-registry/optable/optable-web-sdk-demos:$REF_NAME" \
@@ -187,11 +209,12 @@ jobs:
 
       - name: Publish web-sdk-demos to us-docker.pkg.dev
         env:
-          REF_NAME: ${{ github.ref_name }}
+          REF_NAME: ${{ needs.version.outputs.version }}
         run: docker push "us-docker.pkg.dev/optable-artifact-registry/optable/optable-web-sdk-demos:$REF_NAME"
 
   slack-notification:
-    needs: [tests-prettier, build, deploy-sdk-to-npm, define-gcs-versions-to-update, deploy-sdk-to-gcs, deploy-demo]
+    needs:
+      [version, tests-prettier, build, deploy-sdk-to-npm, define-gcs-versions-to-update, deploy-sdk-to-gcs, deploy-demo]
     runs-on: ubuntu-22.04
     if: ${{ failure() }}
     steps:
@@ -214,7 +237,7 @@ jobs:
                   - type: "mrkdwn"
                     text: "*Status:*\nFailure"
                   - type: "mrkdwn"
-                    text: "*Branch:*\n${{ github.ref_name }}"
+                    text: "*Version:*\n${{ needs.version.outputs.version }}"
                   - type: "mrkdwn"
                     text: "*Author:*\n${{ github.actor || github.triggering_actor }}"
                   - type: "mrkdwn"
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 729e024d..83c0fb89 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -64,8 +64,7 @@ jobs:
   build-vanilla-demo:
     runs-on: ubuntu-22.04
     env:
-      # The ref_name (tag) is not relevant when it runs on something other than a tag so we use latest
-      SDK_URI: https://cdn.optable.co/web-sdk/${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'latest' }}/sdk.js
+      SDK_URI: https://cdn.optable.co/web-sdk/${{ startsWith(inputs.version, 'v') && inputs.version || 'latest' }}/sdk.js
       DCN_HOST: ca.edge.optable.co
       DCN_SITE: web-sdk-demo
       DCN_NODE: optable
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
new file mode 100644
index 00000000..8cb7863b
--- /dev/null
+++ b/.github/workflows/tag.yml
@@ -0,0 +1,85 @@
+name: Tag release
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: "Which part of the version to increment"
+        type: choice
+        options:
+          - minor
+          - major
+          - patch
+        default: minor
+
+permissions:
+  contents: read
+
+jobs:
+  tag:
+    name: Tag master
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.next.outputs.version }}
+    steps:
+      - name: Refuse to release from anything but master
+        if: github.ref != 'refs/heads/master'
+        run: |
+          echo "::error::Release must run on master, got ${{ github.ref }}. Re-run and pick master."
+          exit 1
+
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Compute next version
+        id: next
+        env:
+          BUMP: ${{ inputs.bump }}
+        run: |
+          set -euo pipefail
+          latest=$(git tag -l 'v*' --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true)
+          latest=${latest:-v0.0.0}
+          IFS=. read -r major minor patch <<<"${latest#v}"
+          case "$BUMP" in
+            major) major=$((major + 1)); minor=0; patch=0 ;;
+            minor) minor=$((minor + 1)); patch=0 ;;
+            patch) patch=$((patch + 1)) ;;
+          esac
+          version="v${major}.${minor}.${patch}"
+          echo "${latest} -> ${version}"
+          echo "version=${version}" >>"$GITHUB_OUTPUT"
+          {
+            echo "### Release \`${version}\`"
+            echo ""
+            echo "Previous: \`${latest}\` · bump: \`${BUMP}\` · commit: \`${GITHUB_SHA:0:7}\`"
+          } >>"$GITHUB_STEP_SUMMARY"
+
+      - name: Create and push tag
+        env:
+          VERSION: ${{ steps.next.outputs.version }}
+        run: |
+          set -euo pipefail
+          if git rev-parse -q --verify "refs/tags/${VERSION}" >/dev/null; then
+            echo "::error::${VERSION} already exists. Someone tagged out of band."
+            exit 1
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${VERSION}" -m "Release ${VERSION}"
+          git push origin "${VERSION}"
+
+  release:
+    # Tags pushed with GITHUB_TOKEN don't trigger other workflows, so release.yml is called directly.
+    name: Release
+    needs: tag
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/release.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.tag.outputs.version }}