diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 100a8d3..304588a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,15 @@ name: Release
 on:
   release:
     types: [published]
+  # Pushing a v* tag also releases: the job creates the GitHub release from the
+  # CHANGELOG section first. A release created with GITHUB_TOKEN doesn't fire
+  # `release: published`, so this never runs twice for one tag.
+  push:
+    tags: ['v*']
+
+concurrency:
+  group: release-${{ github.ref_name }}
+  cancel-in-progress: false
 
 jobs:
   build:
@@ -12,6 +21,27 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Create GitHub release for a pushed tag
+        if: github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          if gh release view "${TAG}" > /dev/null 2>&1; then
+            echo "Release ${TAG} already exists"
+            exit 0
+          fi
+          # Release notes are the CHANGELOG section for this version.
+          awk -v ver="${TAG#v}" '
+            /^## \[/ { if (found) exit; if (index($0, "## [" ver "]") == 1) { found = 1; next } }
+            found { print }
+          ' CHANGELOG.md > release-notes.md
+          if [ ! -s release-notes.md ]; then
+            echo "CHANGELOG.md has no section for ${TAG#v}" >&2
+            exit 1
+          fi
+          gh release create "${TAG}" --verify-tag --title "${TAG}" --notes-file release-notes.md
+
       - name: Build release binary
         run: |
           swift build -c release --disable-sandbox
@@ -55,7 +85,7 @@ jobs:
             server.json > server.json.tmp && mv server.json.tmp server.json
 
       - name: Upload release assets
-        run: gh release upload "${GITHUB_REF_NAME}" "${TARBALL}" "${MCPB}"
+        run: gh release upload --clobber "${GITHUB_REF_NAME}" "${TARBALL}" "${MCPB}"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -134,5 +164,9 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add Formula/xcforge.rb
-          git commit -m "Update xcforge to ${VERSION}"
-          git push
+          if git diff --cached --quiet; then
+            echo "Formula already at ${VERSION}"
+          else
+            git commit -m "Update xcforge to ${VERSION}"
+            git push
+          fi