diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..e68e5fe
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,25 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [ opened, reopened, synchronize ]
+
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Test
+        run: mvn test
diff --git a/.github/workflows/create_release.yml b/.github/workflows/prepare_release.yml
similarity index 59%
rename from .github/workflows/create_release.yml
rename to .github/workflows/prepare_release.yml
index ce4a635..64869af 100644
--- a/.github/workflows/create_release.yml
+++ b/.github/workflows/prepare_release.yml
@@ -1,5 +1,5 @@
-name: Create release
-run-name: Create release ${{ inputs.version }} on ${{ github.sha }} by @${{ github.actor }}
+name: Prepare release
+run-name: Prepare release ${{ inputs.version }} on ${{ github.sha }} by @${{ github.actor }}
 
 on:
   workflow_dispatch:
@@ -56,37 +56,3 @@ jobs:
           mvn --batch-mode release:prepare -DreleaseVersion=${{ env.RELEASE_VERSION }} -DdevelopmentVersion=${{ inputs.next }} -Dtag=${{ env.RELEASE_VERSION }} --file pom.xml
         env:
           GITHUB_TOKEN: ${{ secrets.CONDUKTORBOT_REPO_WRITE }}
-
-  publish-release:
-    runs-on: ubuntu-latest
-    needs: create-release
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout tag ${{ env.RELEASE_VERSION }}
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ env.RELEASE_VERSION }}
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@v4
-        with:
-          java-version: '21'
-          distribution: 'temurin'
-
-      - name: maven-settings
-        uses: s4u/maven-settings-action@v2
-        with:
-          servers: '[{"id": "github", "username": "conduktorbot", "password": "${{ secrets.CONDUKTORBOT_GHCR_RW }}" }]'
-          githubServer: false
-
-      - name: Deploy
-        run: mvn -DskipTests deploy
-
-      - name: Create Github Release
-        uses: ncipollo/release-action@v1
-        with:
-          name: "${{ env.RELEASE_VERSION }}"
-          tag: ${{ env.RELEASE_VERSION }}
-          artifacts: "target/azure-kafka-oauthbearer-*.jar"
-          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/publish_release.yml b/.github/workflows/publish_release.yml
new file mode 100644
index 0000000..a47297c
--- /dev/null
+++ b/.github/workflows/publish_release.yml
@@ -0,0 +1,45 @@
+name: Publish release
+run-name: Publish release ${GITHUB_REF#refs/*/} on ${{ github.sha }} by @${{ github.actor }}
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+
+jobs:
+  publish-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Get the Github Release version
+        run: |
+          ref=${GITHUB_REF#refs/*/}
+          git show-ref --verify refs/tags/${ref} || { echo "Ref ${GITHUB_REF} is not a tag" ; exit 1; }
+          echo "RELEASE_VERSION=${ref}" >> "$GITHUB_ENV"
+
+      - name: Checkout tag ${{ env.RELEASE_VERSION }}
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.RELEASE_VERSION }}
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Deploy
+        run: mvn -DskipTests --batch-mode deploy
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create Github Release
+        uses: ncipollo/release-action@v1
+        with:
+          name: "${{ env.RELEASE_VERSION }}"
+          tag: ${{ env.RELEASE_VERSION }}
+          artifacts: "target/azure-kafka-oauthbearer-*.jar"
+          token: ${{ secrets.GITHUB_TOKEN }}