diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fe8286d749..6318ad91cf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,6 +6,8 @@ on:
       - master
       - ci
       - 'release/**'
+    tags:
+      - 'v0.*'
     paths-ignore:
       - 'DOCS/**'
       - 'TOOLS/lua/**'
@@ -789,23 +791,24 @@ jobs:
           cat ./build/meson-logs/testlog.txt
 
   publish:
-    name: Publish git release
+    name: Publish release
     needs: [mingw, mingw64-full, win32, macos]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master' &&
-        github.repository == 'mpv-player/mpv'
+    if: github.event_name == 'push' && github.repository == 'mpv-player/mpv' &&
+        (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v0.'))
     runs-on: ubuntu-slim
     permissions:
       contents: write
       actions: read
     concurrency:
-      group: publish-git
+      group: publish
       cancel-in-progress: false
     steps:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          fetch-tags: true
 
-      - name: Publish to git release
+      - name: Publish
         env:
           GH_REPO: ${{ github.repository }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/ci/publish-release.sh b/ci/publish-release.sh
index 72fe28ccff..22bee11578 100755
--- a/ci/publish-release.sh
+++ b/ci/publish-release.sh
@@ -1,7 +1,10 @@
 #!/usr/bin/env bash
 #
-# Attaches the artifacts of the current workflow run to the rolling
-# "git-release" pre-release and rewrites its notes.
+# Attaches the artifacts of the current workflow run to a GitHub release.
+# A push to master updates the rolling "git-release" pre-release along with
+# its notes. A pushed release tag gets the assets attached to its release,
+# which is created as a draft when it does not exist yet, so the notes can be
+# filled in before publishing.
 #
 # Needs GH_REPO and GH_TOKEN on top of the GITHUB_* variables of the run.
 set -euo pipefail
@@ -13,16 +16,32 @@ artifacts=$(gh api "repos/{owner}/{repo}/actions/runs/$GITHUB_RUN_ID/artifacts")
 windows='mingw32-full|i686-w64-mingw32|windows-msvc'
 published="$windows|macos-|^libmpv-"
 
-tag=git-release
+if [[ $GITHUB_REF == refs/tags/* ]]; then
+    tag=$GITHUB_REF_NAME
+    # Release assets carry the version only, the run id is CI bookkeeping.
+    strip="-$GITHUB_RUN_ID"
+else
+    tag=git-release
+    strip=
+fi
 
 mkdir -p release
 jq -r --arg re "$published" '
     .artifacts[] | select(.name | test($re)) | "\(.id)\t\(.name)"
 ' <<< "$artifacts" |
 while IFS=$'\t' read -r id name; do
-    gh api "repos/{owner}/{repo}/actions/artifacts/$id/zip" > "release/$name.zip"
+    gh api "repos/{owner}/{repo}/actions/artifacts/$id/zip" > "release/${name/$strip/}.zip"
 done
 
+if [[ $tag != git-release ]]; then
+    if gh release view "$tag" >/dev/null 2>&1; then
+        gh release upload "$tag" --clobber release/*
+    else
+        gh release create "$tag" --draft --title "$tag" --notes-file RELEASE_NOTES release/*
+    fi
+    exit 0
+fi
+
 base_url="https://github.com/$GH_REPO/releases/download/$tag"
 
 section() {