diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..17b65ec
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 63be792..1a4c31e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,9 +1,7 @@
 name: Deploy to GitHub Pages
 
 on:
-  push:
-    tags:
-      - "v*"
+  workflow_call:
 
 permissions:
   contents: write
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index ccac01e..98c4e07 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -1,9 +1,12 @@
 name: Publish Docker image
 
 on:
-  push:
-    tags:
-      - 'v*'
+  workflow_call:
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: true
+      DOCKERHUB_TOKEN:
+        required: true
 
 jobs:
   push_to_registry:
diff --git a/.github/workflows/publish-icegraph-client.yml b/.github/workflows/publish-icegraph-client.yml
index 7e09f43..03ffc37 100644
--- a/.github/workflows/publish-icegraph-client.yml
+++ b/.github/workflows/publish-icegraph-client.yml
@@ -1,14 +1,17 @@
 name: Publish icegraph-client to PyPI
 
 on:
-  push:
-    tags:
-      - "v*"
+  workflow_call:
+    secrets:
+      PYPI_API_TOKEN:
+        required: true
 
 jobs:
   publish:
     name: Build and publish to PyPI
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out the repo
         uses: actions/checkout@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..4145cc5
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,79 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions: {}
+
+jobs:
+  docker:
+    name: Docker image
+    uses: ./.github/workflows/docker-publish.yml
+    permissions:
+      contents: read
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+
+  pypi:
+    name: Python client
+    uses: ./.github/workflows/publish-icegraph-client.yml
+    permissions:
+      contents: read
+    secrets:
+      PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+
+  pages:
+    name: Frontend demo
+    uses: ./.github/workflows/deploy.yml
+    permissions:
+      contents: write
+
+  release-notes:
+    name: Write release notes
+    runs-on: ubuntu-latest
+    needs: [docker, pypi, pages]
+    permissions:
+      contents: write
+    steps:
+      - name: Build notes and publish release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
+          DOCKER_IMAGE: yanivzalach/icegraph
+          DEMO_URL: https://yanivzalach.github.io/IceGraph/
+        run: |
+          set -euo pipefail
+
+          VERSION="${TAG#v}"
+          NOTES_FILE="$RUNNER_TEMP/release-notes.md"
+
+          GENERATED="$(gh api "repos/$REPO/releases/generate-notes" -f tag_name="$TAG" --jq .body)"
+          CONTRIBUTORS="$(printf '%s\n' "$GENERATED" | grep -oE '@[A-Za-z0-9-]+' | sort -u | paste -sd , - | sed 's/,/, /g' || true)"
+
+          cat > "$NOTES_FILE" <<EOF
+          ## Artifacts
+
+          | Artifact | Get it |
+          | --- | --- |
+          | 🐳 Docker image | \`docker pull $DOCKER_IMAGE:$TAG\`<br>[Docker Hub](https://hub.docker.com/r/$DOCKER_IMAGE/tags?name=$TAG) |
+          | 🐍 Python client | \`pip install icegraph-client==$VERSION\`<br>[PyPI](https://pypi.org/project/icegraph-client/$VERSION/) |
+          | 🌐 Live demo | [$DEMO_URL]($DEMO_URL) |
+          | 📖 Docs | [${DEMO_URL}docs](${DEMO_URL}docs) |
+
+          EOF
+
+          printf '%s\n' "$GENERATED" >> "$NOTES_FILE"
+
+          if [ -n "$CONTRIBUTORS" ]; then
+            printf '\n## Contributors\n\nThanks to %s 🧊\n' "$CONTRIBUTORS" >> "$NOTES_FILE"
+          fi
+
+          if gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then
+            gh release edit "$TAG" --repo "$REPO" --notes-file "$NOTES_FILE" --latest
+          else
+            gh release create "$TAG" --repo "$REPO" --title "IceGraph $TAG" --notes-file "$NOTES_FILE" --latest
+          fi