diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c21cd01..6be31fa 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -19,3 +19,8 @@ jobs:
               run: |
                 sudo apt-get install skopeo umoci capnproto
             - run: make lint check
+            - name: publish
+              if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
+              run: cargo publish --token ${CRATES_TOKEN}
+              env:
+                CRATES_TOKEN: ${{ secrets.CRATES_TOKEN }}