diff --git a/.bcr/config.yml b/.bcr/config.yml
deleted file mode 100644
index 4ae1875a..00000000
--- a/.bcr/config.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-# See https://github.com/bazel-contrib/publish-to-bcr#a-note-on-release-automation
-# for guidance about whether to uncomment this section:
-
-fixedReleaser:
-  login: aherrmann
-  email: andreash87@gmx.ch
diff --git a/.bcr/metadata.template.json b/.bcr/metadata.template.json
index bf38c1d0..cb6210a6 100644
--- a/.bcr/metadata.template.json
+++ b/.bcr/metadata.template.json
@@ -6,6 +6,12 @@
       "email": "andreash87@gmx.ch",
       "github": "aherrmann",
       "github_user_id": 732652
+    },
+    {
+      "name": "Corentin Kerisit",
+      "email": "corentin.kerisit@gmail.com",
+      "github": "cerisier",
+      "github_user_id": 1126594
     }
   ],
   "repository": ["github:hermeticbuild/rules_zig"],
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5101b44..1e22f230 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,9 +7,17 @@ on:
   push:
     tags:
       - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to release (e.g. v1.2.3). Must already exist."
+        type: string
+        required: true
 
 permissions:
+  attestations: write
   contents: write
+  id-token: write
 
 jobs:
   tests:
@@ -19,19 +27,21 @@ jobs:
 
   release:
     needs: [tests]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Prepare release notes and artifacts
-        run: .github/scripts/release_prep.sh > release_notes.txt
-      - name: Release
-        uses: softprops/action-gh-release@v3
-        with:
-          draft: true
-          prerelease: true
-          # Use GH feature to populate the changelog automatically
-          generate_release_notes: true
-          body_path: release_notes.txt
-          fail_on_unmatched_files: true
-          files: rules_zig-*.tar.gz
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.4.0
+    with:
+      release_files: rules_zig-*.tar.gz
+      prerelease: ${{ contains(inputs.tag || github.ref_name, '-') }}
+      tag_name: ${{ inputs.tag || github.ref_name }}
+
+  publish-to-bcr:
+    needs: [release]
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.2.0
+    with:
+      tag_name: ${{ inputs.tag || github.ref_name }}
+      registry_fork: hermeticbuild/bazel-central-registry
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/scripts/release_prep.sh b/.github/workflows/release_prep.sh
similarity index 100%
rename from .github/scripts/release_prep.sh
rename to .github/workflows/release_prep.sh
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 982da093..b7b47fef 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -36,6 +36,6 @@ repos:
       - id: renovate-config-validator
   # Check validity of GitHub actions configuration
   - repo: https://github.com/mpalmer/action-validator
-    rev: v0.6.0
+    rev: v0.9.0
     hooks:
       - id: action-validator