diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..e2ae992
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,10 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0/).
+
+## [Unreleased]
+
+[Unreleased]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts
diff --git a/cspell.json b/cspell.json
index d9903eb..4de2877 100644
--- a/cspell.json
+++ b/cspell.json
@@ -19,7 +19,16 @@
         "arethetypeswrong",
         "knip",
         "tsgolint",
-        "gitea"
+        "gitea",
+        "pubv",
+        "knope",
+        "runwisp",
+        "glab",
+        "postversion",
+        "Zilla",
+        "kacl",
+        "bestikk",
+        "silverwind"
     ],
     "ignorePaths": ["dist", "node_modules", "coverage", "*.svg", ".gitignore"]
 }
diff --git a/package-lock.json b/package-lock.json
index e8e5be7..0145897 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,6 +10,7 @@
             "license": "MIT",
             "devDependencies": {
                 "@arethetypeswrong/cli": "^0.18.5",
+                "@runwisp/pubv": "^1.5.1",
                 "@tsconfig/node26": "^26.0.1",
                 "@tsconfig/strictest": "^2.0.8",
                 "@types/node": "^26.4.1",
@@ -2299,6 +2300,22 @@
                 "url": "https://bjornlu.com/sponsor"
             }
         },
+        "node_modules/@runwisp/pubv": {
+            "version": "1.5.1",
+            "resolved": "https://registry.npmjs.org/@runwisp/pubv/-/pubv-1.5.1.tgz",
+            "integrity": "sha512-8Tf90OQRJRmRIOXi8Bb0EzRa2rCbi48PG+ISZUTaNpHRrLOy45v8+SpQnigs0Ot6B/9wzseU8AX1Kukg+i+f2A==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "picocolors": "^1.1.1"
+            },
+            "bin": {
+                "pubv": "dist/bin.js"
+            },
+            "engines": {
+                "node": ">=20"
+            }
+        },
         "node_modules/@sindresorhus/is": {
             "version": "4.6.0",
             "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-4.6.0.tgz",
diff --git a/package.json b/package.json
index 2f23f7e..42526e9 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,7 @@
     },
     "files": [
         "dist",
+        "CHANGELOG.md",
         "README.md",
         "LICENSE"
     ],
@@ -48,6 +49,7 @@
         "fix": "npm run fix:oxlint && npm run fix:oxfmt",
         "fix:oxfmt": "oxfmt ${LEFTHOOK_FILES:-.}",
         "fix:oxlint": "oxlint --fix src",
+        "release": "./scripts/release.sh",
         "maintain": "npm run maintain:knip; npm run maintain:outdated",
         "maintain:knip": "knip --include dependencies,exports,files",
         "maintain:outdated": "check-outdated --ignore-pre-releases",
@@ -63,6 +65,7 @@
     },
     "devDependencies": {
         "@arethetypeswrong/cli": "^0.18.5",
+        "@runwisp/pubv": "^1.5.1",
         "@tsconfig/node26": "^26.0.1",
         "@tsconfig/strictest": "^2.0.8",
         "@types/node": "^26.4.1",
diff --git a/scripts/release.sh b/scripts/release.sh
new file mode 100755
index 0000000..7c86f66
--- /dev/null
+++ b/scripts/release.sh
@@ -0,0 +1,66 @@
+#!/bin/sh
+
+set -eu
+
+# Release front-door. Run as `npm run release`.
+#
+# How we got here (short): we want hand-written Keep-a-Changelog notes, an
+# [Unreleased] -> "## [x.y.z] - DATE" graduation, and a tag that marks the exact
+# commit on main that gets published. No single tool did BOTH the [Unreleased]
+# graduation AND the package.json bump. So split by strength: `pubv` (tiny,
+# changelog-driven) owns preflight + the interactive major/minor/patch heuristic
+# + graduating/committing CHANGELOG.md (no tag, no push); `npm version` syncs
+# package.json + the lockfile; `--amend` folds them into pubv's single commit;
+# tag AFTER the amend (so the tag is never orphaned) and push.
+#
+# Rejected: the conventional-commits family (our history is gitmoji, not
+# Conventional; and we want hand-written notes); changesets/rtk (config + a
+# heavier version/publish flow that fights our CI-only publish); knope/kacl/
+# bestikk (changelog-only — don't bump package.json; plus 5yr/2yr/brand-new
+# maintenance); pubv alone (verified it never writes package.json). We also
+# tried `versions` (silverwind) — great Gitea support — but pairing it with a
+# hand-rolled promote became a ~180-line script we'd have to maintain, which is
+# exactly what this ~30-line version replaces.
+
+CHANGELOG="CHANGELOG.md"
+
+if ! command -v code >/dev/null 2>&1; then
+    echo "Error: 'code' (VS Code CLI) not found; install it or remove the editor step." >&2
+    exit 1
+fi
+
+echo "Running pubv..."
+pubv --no-tag --no-push --tag-prefix=none
+
+echo "Opening ${CHANGELOG} in VS Code..."
+code --wait "${CHANGELOG}"
+
+echo "Reading version from ${CHANGELOG}..."
+
+VERSION=$(
+    sed -nE 's/^## \[([0-9]+\.[0-9]+\.[0-9]+)\].*/\1/p' "${CHANGELOG}" |
+        head -n 1
+)
+
+if [ -z "${VERSION}" ]; then
+    echo "Error: Could not determine release version from ${CHANGELOG}." >&2
+    exit 1
+fi
+
+echo "Release version: ${VERSION}"
+
+echo "Updating package.json and package-lock.json..."
+npm version "${VERSION}" --no-git-tag-version
+
+echo "Amending release commit..."
+git add package.json package-lock.json "${CHANGELOG}"
+git commit --amend -m ":bookmark: Release ${VERSION}"
+
+echo "Creating tag ${VERSION}..."
+git tag "${VERSION}"
+
+echo "Pushing release..."
+git push
+git push --tags
+
+echo "Release ${VERSION} completed."