diff --git a/.github/workflows/prepare_release.yml b/.github/workflows/prepare_release.yml
new file mode 100644
index 0000000..33ea9fd
--- /dev/null
+++ b/.github/workflows/prepare_release.yml
@@ -0,0 +1,67 @@
+---
+
+name: Prepare Release
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: 'Module version to be released.'
+        required: true
+        type: string
+      allowed_owner:
+        description: 'Only allow this owner'
+        required: true
+        type: string
+      working-directory:
+        description: The working directory where all jobs should be executed. Used for modules in subdirectories like a monorepo or a control repository.
+        default: '.'
+        required: false
+        type: string
+    secrets:
+      username:
+        description: 'The forge username to use'
+        required: true
+
+env:
+  BUNDLE_WITHOUT: development:test:system_tests
+
+jobs:
+  prepare_release:
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    name: 'Puppet Forge'
+    runs-on: ubuntu-24.04
+    if: github.repository_owner == inputs.allowed_owner
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+          working-directory: ${{ inputs.working-directory }}
+      - name: Update metadata.json to new version
+        run: bundle exec rake module:bump_to_version[${{ inputs.version }}]
+      - name: Update CHANGELOG.md and update REFERENCE.md if required
+        env:
+          # https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication
+          CHANGELOG_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bundle exec rake release:prepare
+      - name: 'Check if a release is necessary'
+        id: 'check'
+        run: |
+          git diff --quiet CHANGELOG.md && echo "release=false" >> $GITHUB_OUTPUT || echo "release=true" >> $GITHUB_OUTPUT
+      - name: 'Commit changes'
+        if: ${{ steps.check.outputs.release == 'true' }}
+        env:
+          # https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config --local user.email "${{ github.repository_owner }}@users.noreply.github.com"
+          git config --local user.name "GitHub Actions"
+          git add .
+          git commit -m "Release v${{ steps.get_version.outputs.version }}"
+          gh pr create --title "Release v${{ steps.get_version.outputs.version }}" --label skip-changelog