diff --git a/.bcr/metadata.template.json b/.bcr/metadata.template.json
new file mode 100644
index 0000000..60b6f87
--- /dev/null
+++ b/.bcr/metadata.template.json
@@ -0,0 +1,16 @@
+{
+  "homepage": "https://github.com/stackb/jvm_image",
+  "maintainers": [
+    {
+      "name": "Paul Johnston",
+      "email": "pcj@stack.build",
+      "github": "pcj",
+      "github_user_id": 50580
+    }
+  ],
+  "repository": [
+    "github:stackb/jvm_image"
+  ],
+  "versions": [],
+  "yanked_versions": {}
+}
diff --git a/.bcr/presubmit.yml b/.bcr/presubmit.yml
new file mode 100644
index 0000000..08475b2
--- /dev/null
+++ b/.bcr/presubmit.yml
@@ -0,0 +1,12 @@
+bcr_test_module:
+  module_path: "example/hello"
+  matrix:
+    platform: ["macos", "ubuntu2204"]
+    bazel: ["8.*"]
+  tasks:
+    build_example:
+      name: "Build example image"
+      platform: ${{ platform }}
+      bazel: ${{ bazel }}
+      build_targets:
+        - "//:image"
diff --git a/.bcr/source.template.json b/.bcr/source.template.json
new file mode 100644
index 0000000..2037471
--- /dev/null
+++ b/.bcr/source.template.json
@@ -0,0 +1,5 @@
+{
+  "integrity": "",
+  "strip_prefix": "{REPO}-{VERSION}",
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{TAG}.tar.gz"
+}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..1f41bb9
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,33 @@
+name: Publish to BCR
+
+on:
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      BCR_PUBLISH_TOKEN:
+        required: false
+      publish_token:
+        required: true
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: Existing release tag to publish
+        required: true
+        type: string
+
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@c316f1611511a40423572303f66c80bb30bfe2f8 # v1.4.1
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      registry_fork: stackb/bazel-central-registry
+      draft: true
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..8a7d22b
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,43 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: Existing tag to release
+        required: true
+        type: string
+
+permissions:
+  attestations: write
+  contents: write
+  id-token: write
+
+jobs:
+  release:
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@1d798ff015ed0696433e01e2c3ccbb2abefadad7 # v7.7.0
+    with:
+      release_files: jvm_image-*.tar.gz
+      prerelease: false
+      draft: true
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish.yml
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
+
+  finalize:
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        with:
+          tag_name: ${{ inputs.tag_name || github.ref_name }}
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
new file mode 100755
index 0000000..0fad57a
--- /dev/null
+++ b/.github/workflows/release_prep.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+
+readonly TAG="${1:?release tag is required}"
+if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+  echo "release tag must be a semantic version prefixed with v: $TAG" >&2
+  exit 1
+fi
+
+if [[ ! -f LICENSE && ! -f LICENSE.txt && ! -f LICENSE.md ]]; then
+  echo "a repository license is required before publishing a release" >&2
+  exit 1
+fi
+
+readonly VERSION="${TAG#v}"
+readonly PREFIX="jvm_image-${VERSION}"
+readonly ARCHIVE="jvm_image-${TAG}.tar.gz"
+
+git archive --format=tar --prefix="${PREFIX}/" "$TAG" | gzip -n >"$ARCHIVE"
+SHA256="$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')"
+readonly SHA256
+
+cat <<EOF
+## Bzlmod
+
+Add the module dependency to your \`MODULE.bazel\`:
+
+\`\`\`starlark
+bazel_dep(name = "jvm_image", version = "${VERSION}")
+\`\`\`
+
+Release archive SHA-256: \`${SHA256}\`
+EOF
diff --git a/MODULE.bazel b/MODULE.bazel
index a78567c..92b8383 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -2,7 +2,6 @@
 
 module(
     name = "jvm_image",
-    version = "0.1.0",
 )
 
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
diff --git a/README.md b/README.md
index a092db7..c0cf6bd 100644
--- a/README.md
+++ b/README.md
@@ -104,3 +104,10 @@ bazel build //:image
 
 The example in [`example/hello`](example/hello) demonstrates `jvm_jar_layers`
 with `rules_img`.
+
+## Releasing
+
+Before onboarding a client, pin a green commit, choose and add a repository
+license, and publish a matching `v0.1.x` tag. A license is intentionally not
+inferred by this repository. See [`RELEASING.md`](RELEASING.md) for the GitHub
+release and Bazel Central Registry process.
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..aee37f0
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,39 @@
+# Releasing
+
+Releases are created from semantic-version tags such as `v0.1.0`. The release
+workflow creates an attested source archive, opens a Bazel Central Registry
+(BCR) pull request, and publishes the draft GitHub release after the BCR publish
+job succeeds.
+
+## One-time setup
+
+1. Choose and add the repository license before the first public release.
+2. Keep the `stackb/bazel-central-registry` fork synchronized with
+   `bazelbuild/bazel-central-registry`.
+3. Add an Actions secret named `BCR_PUBLISH_TOKEN`. Use a classic personal
+   access token belonging to the account that can push to the fork and open a
+   pull request against the upstream BCR. It needs `repo` and `workflow` scopes.
+4. Review `.bcr/metadata.template.json`, especially the maintainer email, before
+   the first publication.
+
+## Cut a release
+
+1. Ensure CI is green and the checkout is clean.
+2. Confirm the release notes and public API are ready.
+3. Create and push the tag:
+
+   ```sh
+   git tag -a v0.1.0 -m "v0.1.0"
+   git push origin v0.1.0
+   ```
+
+The tag starts `.github/workflows/release.yml`. If BCR publication needs to be
+retried without recreating the GitHub release, run the **Publish to BCR**
+workflow manually and supply the existing tag.
+
+The BCR pull request is intentionally opened as a draft. The token owner must
+mark it ready for review, which serves as the maintainer approval recognized by
+the BCR.
+
+The release preparation step rejects malformed tags and refuses to publish
+until a `LICENSE`, `LICENSE.txt`, or `LICENSE.md` file exists.
diff --git a/example/hello/MODULE.bazel b/example/hello/MODULE.bazel
index 68fc98e..9523fef 100644
--- a/example/hello/MODULE.bazel
+++ b/example/hello/MODULE.bazel
@@ -10,7 +10,8 @@ module(
 bazel_dep(name = "rules_img", version = "0.3.4")
 bazel_dep(name = "rules_java", version = "9.6.1")
 bazel_dep(name = "rules_jvm_external", version = "6.7")
-bazel_dep(name = "jvm_image", version = "0.1.0")
+
+bazel_dep(name = "jvm_image", version = "0.0.0", dev_dependency = True)
 local_path_override(
     module_name = "jvm_image",
     path = "../..",