diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..a36fb9d
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,59 @@
+name: Publish package to PyPI
+
+on:
+  release:
+    types:
+    - published
+
+jobs:
+  build:
+    name: Build distribution packages
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Python 3.10
+      uses: actions/setup-python@v4
+      with:
+        python-version: "3.10"
+    - name: Install pypa/build
+      run: |
+        python -m pip install --user build
+    - name: Build packages
+      run: |
+        pyproject-build
+    - uses: actions/upload-artifact@v3
+      with:
+        name: dist
+        path: dist/
+        if-no-files-found: error
+  publish-to-test-pypi:
+    name: Publish packages to Test PyPI
+    runs-on: ubuntu-latest
+    needs: [build]
+    environment: test-pypi
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: dist
+        path: dist/
+    - name: Publish packages to Test PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        password: '${{ secrets.TEST_PYPI_API_TOKEN }}'
+        repository_url: https://test.pypi.org/legacy/
+        print_hash: true
+  publish-to-pypi:
+    name: Publish packages to PyPI
+    runs-on: ubuntu-latest
+    needs: [build]
+    environment: pypi
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: dist
+        path: dist/
+    - name: Publish packages to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        password: '${{ secrets.PYPI_API_TOKEN }}'
+        print_hash: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 9e08632..3cb4030 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -43,6 +43,6 @@ repos:
         args: [--py3-plus]
 
 -   repo: https://github.com/rhysd/actionlint
-    rev: v1.6.15
+    rev: v1.6.23
     hooks:
     -   id: actionlint-docker
diff --git a/README.rst b/README.rst
index 69cabb7..aa6cbb9 100644
--- a/README.rst
+++ b/README.rst
@@ -218,18 +218,26 @@ Preparing a release
 For package maintainers, here is how we release a new version:
 
 #. Ensure that the ``CHANGES`` file is up to date with the latest changes.
-#. Create a tag whose name is the `PEP 440`_-compliant version number prefixed
-   by ``v``, making sure to include at least three version number components
-   (e.g. ``v0.6.0``).
-#. Make sure that all tests pass on the tagged version.
-#. Push the tag to Github.
-#. Make a fresh clone of the repository, and in the root directory of the new
-   clone, run ``pyproject-build`` (from the `build`_ package). This will create
-   source and wheel packages under ``dist/``.
-#. Upload the source and wheel to PyPI using ``twine upload`` (see `twine`_).
-#. Using the `new release form on Github`_, prepare notes for the new release
-   following the pattern of previous releases. The "Auto-generate release notes"
-   button will be useful in summarizing the changes since the last release.
+#. Make sure that all tests pass on the version you want to release.
+#. Use the `new release form on Github`_ (or some other equivalent method) to
+   create a new release, following the pattern of previous releases.
+
+   * Each release has to be based on a tag. You can either create the tag first
+     (e.g. using ``git tag``) and then make a release from that tag, or you can
+     have Github create the tag as part of the process of making a release;
+     either way works.
+   * The tag name **must** be the `PEP 440`_-compliant version number prefixed
+     by ``v``, making sure to include at least three version number components
+     (e.g. ``v0.6.0``).
+   * The "Auto-generate release notes" button will be useful in summarizing
+     the changes since the last release.
+
+#. Using either the `release workflows page`_ or the link in the email you
+   received about a "Deployment review", go to the workflow run created for
+   the new release and click "Review deployments", then either approve or reject
+   the two deployments, one to Test PyPI and one to real PyPI. (It should not be
+   necessary to reject a deployment unless something really weird happens.)
+   Once the deployment is approved, Github will automatically upload the files.
 
 ----
 
@@ -254,3 +262,4 @@ For package maintainers, here is how we release a new version:
 .. _build: https://pypa-build.readthedocs.io/en/latest/
 .. _twine: https://twine.readthedocs.io/en/stable/
 .. _new release form on Github: https://github.com/pytest-dev/pytest-localserver/releases/new
+.. _release workflows page: https://github.com/pytest-dev/pytest-localserver/actions/workflows/release.yml