diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f033280c..5b373d1e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,6 @@
 # Shared go-service CI from compliance-framework/workflows, pinned to a release commit that
-# ccf-bump moves. The status check to require is `ci / required`.
+# ccf-bump moves. The status checks to require are `ci / required` and
+# `release-checks / release-checks` (skipped, so passing, on non-release PRs).
 name: ci
 
 on:
@@ -30,8 +31,13 @@ jobs:
       security-events: write
     secrets: inherit
 
+  release-checks:
+    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@899dbe5d7dac02de5fd60a92d764b189259e03dd # v1.5.0
+    permissions:
+      contents: read
+
   notify:
-    needs: [ci]
+    needs: [ci, release-checks]
     if: always()
     uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@899dbe5d7dac02de5fd60a92d764b189259e03dd # v1.5.0
     with:
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 00000000..a894a024
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,21 @@
+# Opens and updates the release PR from the conventional commits on main, and creates the
+# vX.Y.Z tag and GitHub release when that PR merges, as ccf-release-bot. The config is
+# release-please-config.json (the shared defaults) and .release-please-manifest.json.
+name: release-please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-please
+
+jobs:
+  release-please:
+    uses: compliance-framework/workflows/.github/workflows/release-please.yml@899dbe5d7dac02de5fd60a92d764b189259e03dd # v1.5.0
+    permissions:
+      contents: read
+    secrets: inherit
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 00000000..d3535156
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "0.21.0"
+}
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 00000000..c15965c4
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bump-minor-pre-major": true,
+  "initial-version": "0.1.0",
+  "bootstrap-sha": "0b0cefc039302a63d356cda7528c796a2113bf08",
+  "changelog-sections": [
+    { "type": "feat", "section": "Features" },
+    { "type": "fix", "section": "Bug Fixes" },
+    { "type": "perf", "section": "Performance Improvements" },
+    { "type": "revert", "section": "Reverts" },
+    { "type": "deps", "section": "Dependencies" },
+    { "type": "chore", "section": "Miscellaneous Chores", "hidden": true },
+    { "type": "ci", "section": "Continuous Integration", "hidden": true },
+    { "type": "docs", "section": "Documentation", "hidden": true },
+    { "type": "test", "section": "Tests", "hidden": true },
+    { "type": "refactor", "section": "Code Refactoring", "hidden": true },
+    { "type": "build", "section": "Build System", "hidden": true }
+  ],
+  "packages": {
+    ".": { "release-type": "go" }
+  }
+}