diff --git a/.github/workflows/publish-to-test-pypi.yml b/.github/workflows/publish-to-test-pypi.yml
deleted file mode 100644
index a074aa6..0000000
--- a/.github/workflows/publish-to-test-pypi.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: Publish Python 🐍 distributions 📦 to PyPI and TestPyPI
-
-on:
-  push:
-    branches:
-      - development
-      - main
-
-jobs:
-  build-n-publish:
-    name: Build and publish Python 🐍 distributions 📦 to PyPI and TestPyPI
-    runs-on: ubuntu-latest
-    
-    steps:
-      - uses: actions/checkout@master
-      
-      - name: Set up Python 3.10
-        uses: actions/setup-python@v3
-        with:
-          python-version: "3.10"
-          
-      - name: Install pypa/build
-        run: |
-          python -m pip install build --user
-      
-      - name: Build a binary wheel and a source tarball
-        run: |
-          python -m build --sdist --wheel --outdir dist/ .
-      
-      - name: Publish distribution 📦 to Test PyPI (development)
-        if: github.ref == 'refs/heads/development'
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password : ${{ secrets.TEST_PYPI_API_TOKEN }}
-          repository_url : https://test.pypi.org/legacy/
-        
-      - name : Publish distribution 📦 to PyPi (main)
-        if: github.ref == 'refs/heads/main'
-        uses : pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..304ceb8
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,54 @@
+name: Publish to PyPI
+
+# A release is a tag, not a push to main:
+#   1. bump __version__ in partialjson/__init__.py and add a CHANGELOG entry
+#   2. merge to main
+#   3. git tag vX.Y.Z && git push origin vX.Y.Z
+# Pushes to the "development" branch still go to TestPyPI.
+
+on:
+  push:
+    tags:
+      - "v*"
+    branches:
+      - development
+
+jobs:
+  build-n-publish:
+    name: Build and publish
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Check that the tag matches the package version
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(python -c 'import re; print(re.search(r"__version__ = \"([^\"]+)\"", open("partialjson/__init__.py").read()).group(1))')"
+          if [ "$tag" != "$version" ]; then
+            echo "Tag v$tag does not match __version__ = $version" >&2
+            exit 1
+          fi
+
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build --sdist --wheel --outdir dist/ .
+
+      - name: Publish to TestPyPI (development branch)
+        if: github.ref == 'refs/heads/development'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
+          repository-url: https://test.pypi.org/legacy/
+
+      - name: Publish to PyPI (tag)
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
diff --git a/README.md b/README.md
index 0a32bab..168d5f9 100644
--- a/README.md
+++ b/README.md
@@ -113,7 +113,7 @@ Please refer to each project's style and contribution guidelines for submitting
 
 1.  **Fork** the repo on GitHub
 2.  **Clone** the project to your own machine
-3.  **Update the Version** inside `partialjson/__init__.py` and add a `CHANGELOG.md` entry
+3.  **Update the Version** inside `partialjson/__init__.py` and add a `CHANGELOG.md` entry (a release is published to PyPI when a `vX.Y.Z` tag is pushed, not on merge)
 4.  **Commit** changes to your own branch
 5.  **Push** your work back up to your fork
 6.  Submit a **Pull request** so that we can review your changes