diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 703f24098..21251bcff 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -122,32 +122,3 @@ jobs:
         done
         make test-e2e
 
-  publish:
-    name: Publish container image to Quay
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    if: ${{ github.event.repository.fork == false && github.event_name == 'push' }}
-    needs:
-    - check-license
-    - generate
-    - build
-    - unit-tests
-    - e2e-tests
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
-
-    - name: Setup Golang Environment
-      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
-      with:
-        go-version: ${{ env.go-version }}
-
-    - name: Login to Quay.io
-      uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
-      with:
-        registry: quay.io
-        username: ${{ secrets.QUAY_USERNAME }}
-        password: ${{ secrets.QUAY_PASSWORD }}
-
-    - name: Build images and push
-      run: ./scripts/publish.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..14ff99f2d
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,29 @@
+name: Release
+on:
+  push:
+    tags:
+    - 'v*'
+env:
+  QUAY_PATH: quay.io/brancz/kube-rbac-proxy
+  go-version: '1.25'
+jobs:
+  publish:
+    name: Publish container image to Quay
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+    - name: Checkout
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+    - name: Setup golang for building
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      with:
+        go-version: ${{ env.go-version }}
+    - name: Login to Quay.io
+      uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+      with:
+        registry: quay.io
+        username: ${{ secrets.QUAY_USERNAME }}
+        password: ${{ secrets.QUAY_PASSWORD }}
+    - name: Build images and push
+      run: ./scripts/publish.sh
+