diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f0a59758..d2a3fab0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ["trunk"]
 
+permissions:
+  contents: read
+
 jobs:
   tox:
     name: "tox -e ${{ matrix.tox-env }}"
@@ -32,8 +35,8 @@ jobs:
 
     - run: "python -m pip install tox"
 
-      # Temporary hack: create files normally created by Webpack that are
-      # expected to exist by the manifest.json view test.
+      # Temporary hack: create files normally created by bin/compile-static.py
+      # that are expected to exist by the manifest.json view test.
     - run: |
         mkdir yarrharr/static
         touch yarrharr/static/{icon,logotype,lettertype}-xyz.{ico,png,svg}
@@ -42,7 +45,7 @@ jobs:
 
     - run: "python -m tox"
 
-  webpack:
+  build:
     name: "tox -e static"
 
     runs-on: ubuntu-24.04
@@ -67,3 +70,11 @@ jobs:
     - run: "python -m tox -e static --notest"
 
     - run: "tox -e static"
+
+    - run: "bin/release.sh"
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: dist
+        path: dist/*.*
+        if-no-files-found: error
diff --git a/bin/release.sh b/bin/release.sh
new file mode 100755
index 00000000..ce770ab8
--- /dev/null
+++ b/bin/release.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -exu -o pipefail
+git diff --quiet HEAD || exit 1
+tox -e release --notest
+version=$(.tox/release/bin/hatch version)
+.tox/release/bin/python -m build
+.tox/release/bin/python -m twine check "dist/yarrharr-${version}.tar.gz" "dist/yarrharr-${version}-py3-none-any.whl"
+git tag "v${version}"
diff --git a/justfile b/justfile
index de729f74..486bc75d 100644
--- a/justfile
+++ b/justfile
@@ -9,14 +9,7 @@ _static:
     tox -e static
 
 release: _static
-    #!/usr/bin/env bash
-    set -exu -o pipefail
-    git diff --quiet HEAD || exit 1
-    tox -e release --notest
-    version=$(grep -oP '(?<=__version__ = ")([^"]+)(?=")' yarrharr/__init__.py)
-    .tox/release/bin/python -m build
-    .tox/release/bin/python -m twine check "dist/yarrharr-${version}.tar.gz" "dist/yarrharr-${version}-py3-none-any.whl"
-    git tag "v${version}"
+    bin/release.sh
 
 devserver: _static
     tox -e run -- django-admin migrate