diff --git a/.github/workflows/build-gems.yml b/.github/workflows/build-gems.yml
new file mode 100644
index 00000000..7241acb1
--- /dev/null
+++ b/.github/workflows/build-gems.yml
@@ -0,0 +1,108 @@
+name: Build gems
+on:
+  workflow_call:
+    inputs:
+      release:
+        description: "Pass --release to bin/test-gem-build (skip timestamp version)"
+        type: boolean
+        default: false
+      artifact_prefix:
+        description: "Prefix for artifact names (e.g., 'release-v2.9.1-')"
+        type: string
+        default: ""
+      ref:
+        description: "Git ref to check out (e.g., a version tag). Defaults to the caller's ref."
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  native_setup:
+    name: "Setup for native gem build"
+    runs-on: ubuntu-latest
+    outputs:
+      rcd_image_version: ${{ steps.rcd_image_version.outputs.rcd_image_version }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false
+      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: ports/archives
+          key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
+      - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
+        with:
+          ruby-version: "4.0"
+          bundler-cache: true
+      - run: bundle exec ruby ./ext/sqlite3/extconf.rb --download-dependencies
+      - id: rcd_image_version
+        run: bundle exec ruby -e 'require "rake_compiler_dock"; puts "rcd_image_version=#{RakeCompilerDock::IMAGE_VERSION}"' >> $GITHUB_OUTPUT
+
+  build_source_gem:
+    name: "build source"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false
+      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: ports/archives
+          key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
+      - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
+        with:
+          ruby-version: "4.0"
+          bundler-cache: true
+      - run: ./bin/test-gem-build ${RELEASE_FLAG} gems ruby
+        env:
+          RELEASE_FLAG: ${{ inputs.release && '--release' || '' }}
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: "${{ inputs.artifact_prefix }}source-gem"
+          path: gems
+          retention-days: 1
+
+  build_native_gem:
+    needs: native_setup
+    name: "build native"
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - aarch64-linux-gnu
+          - aarch64-linux-musl
+          - arm-linux-gnu
+          - arm-linux-musl
+          - arm64-darwin
+          - x64-mingw-ucrt
+          - x86-linux-gnu
+          - x86-linux-musl
+          - x86_64-darwin
+          - x86_64-linux-gnu
+          - x86_64-linux-musl
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false
+      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        with:
+          path: ports/archives
+          key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb', 'dependencies.yml') }}
+      - run: |
+          docker run --rm -v $PWD:/work -w /work \
+            ghcr.io/rake-compiler/rake-compiler-dock-image:${RCD_IMAGE_VERSION}-mri-${{ matrix.platform }} \
+            ./bin/test-gem-build ${RELEASE_FLAG} gems ${{ matrix.platform }}
+        env:
+          RCD_IMAGE_VERSION: ${{ needs.native_setup.outputs.rcd_image_version }}
+          RELEASE_FLAG: ${{ inputs.release && '--release' || '' }}
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: "${{ inputs.artifact_prefix }}cruby-${{ matrix.platform }}-gem"
+          path: gems
+          retention-days: 1
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4b27b496..6520ab1e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -194,55 +194,17 @@ jobs:
       - run: bundle exec rake test:valgrind
 
   #
-  #  gem tests (source and native)
+  #  gem build (source and native)
   #
-  native_setup:
+  build_gems:
     needs: basic
-    name: "Setup for native gem tests"
-    runs-on: ubuntu-latest
-    outputs:
-      rcd_image_version: ${{ steps.rcd_image_version.outputs.rcd_image_version }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
-        with:
-          path: ports/archives
-          key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
-      - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
-        with:
-          ruby-version: "4.0"
-          bundler-cache: true # zizmor: ignore[cache-poisoning]
-      - run: bundle exec ruby ./ext/sqlite3/extconf.rb --download-dependencies
-      - id: rcd_image_version
-        run: bundle exec ruby -e 'require "rake_compiler_dock"; puts "rcd_image_version=#{RakeCompilerDock::IMAGE_VERSION}"' >> $GITHUB_OUTPUT
-
-  build_source_gem:
-    needs: native_setup
-    name: "build source"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
-        with:
-          path: ports/archives
-          key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
-      - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
-        with:
-          ruby-version: "4.0"
-          bundler-cache: true # zizmor: ignore[cache-poisoning]
-      - run: ./bin/test-gem-build gems ruby
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: source-gem
-          path: gems
-          retention-days: 1
+    uses: ./.github/workflows/build-gems.yml
 
+  #
+  #  gem tests (source and native)
+  #
   install_source_linux:
-    needs: [build_source_gem, ruby_versions]
+    needs: [build_gems, ruby_versions]
     name: "test source"
     strategy:
       fail-fast: false
@@ -270,48 +232,9 @@ jobs:
       - run: ./bin/test-gem-install gems -- --${{ matrix.syslib }}-system-libraries ${{ matrix.compile_flags }}
         shell: sh
 
-  build_native_gem:
-    needs: native_setup
-    name: "build native"
-    strategy:
-      fail-fast: false
-      matrix:
-        platform:
-          - aarch64-linux-gnu
-          - aarch64-linux-musl
-          - arm-linux-gnu
-          - arm-linux-musl
-          - arm64-darwin
-          - x64-mingw-ucrt
-          - x86-linux-gnu
-          - x86-linux-musl
-          - x86_64-darwin
-          - x86_64-linux-gnu
-          - x86_64-linux-musl
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
-        with:
-          path: ports/archives
-          key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
-      - run: |
-          docker run --rm -v $PWD:/work -w /work \
-            ghcr.io/rake-compiler/rake-compiler-dock-image:${NEEDS_NATIVE_SETUP_OUTPUTS_RCD_IMAGE_VERSION}-mri-${{ matrix.platform }} \
-            ./bin/test-gem-build gems ${{ matrix.platform }}
-        env:
-          NEEDS_NATIVE_SETUP_OUTPUTS_RCD_IMAGE_VERSION: ${{ needs.native_setup.outputs.rcd_image_version }}
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: "cruby-${{ matrix.platform }}-gem"
-          path: gems
-          retention-days: 1
-
   test_architecture_matrix:
     name: "${{ matrix.platform }} ${{ matrix.ruby }}"
-    needs: [build_native_gem, ruby_versions]
+    needs: [build_gems, ruby_versions]
     strategy:
       fail-fast: false
       matrix:
@@ -359,7 +282,7 @@ jobs:
 
   test_the_rest:
     name: "${{ matrix.platform }} ${{ matrix.ruby }}"
-    needs: [build_native_gem, ruby_versions]
+    needs: [build_gems, ruby_versions]
     strategy:
       fail-fast: false
       matrix:
@@ -388,7 +311,7 @@ jobs:
         shell: sh
 
   cruby-x86_64-linux-musl-install:
-    needs: build_native_gem
+    needs: build_gems
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 43ba6abf..f76d642b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,10 +1,46 @@
 name: release
+concurrency:
+  group: "release-${{ inputs.version_tag }}"
+  cancel-in-progress: false
 
 on:
   workflow_dispatch:
+    inputs:
+      version_tag:
+        description: "Version tag to release (e.g., v2.9.1)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
 
 jobs:
-  hello:
+  build:
+    uses: ./.github/workflows/build-gems.yml
+    with:
+      release: true
+      artifact_prefix: "release-${{ inputs.version_tag }}-"
+      ref: ${{ inputs.version_tag }}
+
+  push:
+    name: "Push gems to RubyGems.org"
+    needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - run: echo "Hello, world!"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: gems
+          pattern: "release-${{ inputs.version_tag }}-*-gem"
+          merge-multiple: true
+      - name: Print checksums
+        run: ls gems/*.gem | sort | xargs sha256sum
+      - uses: rubygems/configure-rubygems-credentials@bc6dd217f8a4f919d6835fcfefd470ef821f5c44 # v1.0.0
+      - name: Push gems
+        run: |
+          for gem in gems/*.gem; do
+            echo "Pushing ${gem} ..."
+            gem push "${gem}" || echo "WARNING: Failed to push ${gem} (may already exist)"
+          done
diff --git a/bin/test-gem-build b/bin/test-gem-build
index d4502abb..249f23a3 100755
--- a/bin/test-gem-build
+++ b/bin/test-gem-build
@@ -1,9 +1,15 @@
 #! /usr/bin/env bash
 #
-#  run as part of CI
+#  run as part of CI, or as part of the release pipeline with --release
 #
+RELEASE=false
+if [[ "${1:-}" == "--release" ]] ; then
+  RELEASE=true
+  shift
+fi
+
 if [[ $# -lt 2 ]] ; then
-  echo "usage: $(basename $0) <output_dir> <platform>"
+  echo "usage: $(basename $0) [--release] <output_dir> <platform>"
   exit 1
 fi
 
@@ -18,7 +24,10 @@ set -x
 
 bundle config set without development
 bundle install --local || bundle install
-bundle exec rake set-version-to-timestamp
+
+if [[ "${RELEASE}" == "false" ]] ; then
+  bundle exec rake set-version-to-timestamp
+fi
 
 if [[ "${BUILD_NATIVE_GEM}" == "ruby" ]] ; then
   bundle exec ruby ext/sqlite3/extconf.rb --download-dependencies