diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..3144bb3
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,90 @@
+name: Release
+
+on:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: "20"
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run tests
+        run: pnpm test
+
+      - name: Run typecheck
+        run: pnpm typecheck
+
+      - name: Build package
+        run: pnpm build
+
+  publish:
+    needs: verify
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify tag matches package version
+        run: |
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+
+          if [ "$PACKAGE_VERSION" != "$TAG_VERSION" ]; then
+            echo "Tag version $TAG_VERSION does not match package.json version $PACKAGE_VERSION"
+            exit 1
+          fi
+
+      - name: Publish to npm
+        run: pnpm publish --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
diff --git a/README.md b/README.md
index 64343f0..86f284f 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,7 @@ After install, use the `codexm` command.
 ## Commands
 
 ```bash
+codexm --version
 codexm current
 codexm list [name]
 codexm save <name>
diff --git a/package.json b/package.json
index 4547881..e7a9249 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codex-team",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Manage multiple Codex ChatGPT auth snapshots and quota usage from the command line.",
   "license": "MIT",
   "type": "module",
diff --git a/src/main.ts b/src/main.ts
index 0fc1f92..2db5423 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -2,6 +2,7 @@ import { stdin as defaultStdin, stdout as defaultStdout, stderr as defaultStderr
 import dayjs from "dayjs";
 import timezone from "dayjs/plugin/timezone.js";
 import utc from "dayjs/plugin/utc.js";
+import packageJson from "../package.json";
 
 import { maskAccountId } from "./auth-snapshot.js";
 import {
@@ -98,6 +99,8 @@ function printHelp(stream: NodeJS.WriteStream): void {
   stream.write(`codexm - manage multiple Codex ChatGPT auth snapshots
 
 Usage:
+  codexm --version
+  codexm --help
   codexm current [--json]
   codexm list [name] [--json]
   codexm save <name> [--force] [--json]
@@ -449,6 +452,11 @@ export async function runCli(
   const json = parsed.flags.has("--json");
 
   try {
+    if (parsed.flags.has("--version")) {
+      streams.stdout.write(`${packageJson.version}\n`);
+      return 0;
+    }
+
     if (!parsed.command || parsed.flags.has("--help")) {
       printHelp(streams.stdout);
       return 0;
diff --git a/tests/cli.test.ts b/tests/cli.test.ts
index 2736261..c186548 100644
--- a/tests/cli.test.ts
+++ b/tests/cli.test.ts
@@ -4,6 +4,7 @@ import { describe, expect, test } from "@rstest/core";
 import dayjs from "dayjs";
 import timezone from "dayjs/plugin/timezone.js";
 import utc from "dayjs/plugin/utc.js";
+import packageJson from "../package.json";
 
 import { runCli } from "../src/main.js";
 import { createAccountStore } from "../src/account-store.js";
@@ -70,6 +71,34 @@ function createInteractiveStdin(): NodeJS.ReadStream & {
 }
 
 describe("CLI", () => {
+  test("prints version from --version", async () => {
+    const stdout = captureWritable();
+    const stderr = captureWritable();
+
+    const exitCode = await runCli(["--version"], {
+      stdout: stdout.stream,
+      stderr: stderr.stream,
+    });
+
+    expect(exitCode).toBe(0);
+    expect(stdout.read()).toBe(`${packageJson.version}\n`);
+    expect(stderr.read()).toBe("");
+  });
+
+  test("includes version flag in help output", async () => {
+    const stdout = captureWritable();
+    const stderr = captureWritable();
+
+    const exitCode = await runCli(["--help"], {
+      stdout: stdout.stream,
+      stderr: stderr.stream,
+    });
+
+    expect(exitCode).toBe(0);
+    expect(stdout.read()).toContain("codexm --version");
+    expect(stderr.read()).toBe("");
+  });
+
   test("supports save and current in json mode", async () => {
     const homeDir = await createTempHome();