diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..4b83db7
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,31 @@
+name: Release
+
+on: workflow_dispatch
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: install wasm-bindgen-cli
+        run: cargo install wasm-bindgen-cli
+      - name: install wasm-unknown-unknown target
+        run: rustup target add wasm32-unknown-unknown
+      - uses: pnpm/action-setup@v2
+        with:
+          version: 8
+      - name: install dependencies
+        run: pnpm install
+      - name: install dependencies
+        run: pnpm install
+      - name: Create Release Pull Request or Publish to npm
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          publish: pnpm publish
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 99560c8..120dea8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -54,5 +54,5 @@ pnpm test:e2e
 To publish the packages (opaque and opaque-p256) you can run
 
 ```sh
-pnpm publish:all
+pnpm publish
 ```
diff --git a/SECURITY.md b/SECURITY.md
index 9ada208..acbef98 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,9 +2,7 @@
 
 ## Supported Versions
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.8.0   | :white_check_mark: |
+The most resent version of the library is supported.
 
 ## Reporting a Vulnerability
 
diff --git a/bin/build.js b/bin/build.js
index 1cde19d..a29c956 100644
--- a/bin/build.js
+++ b/bin/build.js
@@ -1,9 +1,14 @@
 const sh = require("shelljs");
+const path = require("path");
 
 // throw if a command fails
 sh.config.fatal = true;
 
-const rootPkg = JSON.parse(sh.cat("package.json").toString());
+const ristrettoPackageJson = JSON.parse(
+  sh
+    .cat(path.join(__dirname, "..", "build", "ristretto", "package.json"))
+    .toString(),
+);
 
 const packageJson = function (name) {
   return new sh.ShellString(`{
@@ -13,7 +18,7 @@ const packageJson = function (name) {
     "Stefan Oestreicher <oestef@gmail.com>",
     "Nik Graf <nik@nikgraf.com>"
   ],
-  "version": "${rootPkg.version}",
+  "version": "${ristrettoPackageJson.version}",
   "license": "MIT",
   "files": [
     "index.d.ts",
diff --git a/package.json b/package.json
index ca79d7f..3a8fc99 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,5 @@
 {
   "name": "opaque-monorepo",
-  "version": "0.8.0",
   "license": "MIT",
   "private": true,
   "devDependencies": {
@@ -34,14 +33,9 @@
     "test:p256": "cross-env OPAQUE_BUILD=p256 jest",
     "test:ristretto": "jest",
     "test": "pnpm test:p256 && pnpm test:ristretto",
-    "publish:ristretto": "cd build/ristretto && pnpm publish",
-    "publish:p256": "cd build/p256 && pnpm publish",
-    "publish:all": "pnpm publish:ristretto && pnpm publish:p256",
+    "publish": "pnpm build && pnpm changeset publish",
     "typecheck": "tsc --noEmit && pnpm typecheck:fullstack-simple-nextjs && pnpm typecheck:fullstack-e2e-encrypted-locker-nextjs",
     "typecheck:fullstack-simple-nextjs": "cd examples/fullstack-simple-nextjs && tsc --noEmit",
-    "typecheck:fullstack-e2e-encrypted-locker-nextjs": "cd examples/fullstack-e2e-encrypted-locker-nextjs && tsc --noEmit",
-    "changeset": "changeset",
-    "publish:packages": "changeset publish",
-    "version:packages": "changeset version"
+    "typecheck:fullstack-e2e-encrypted-locker-nextjs": "cd examples/fullstack-e2e-encrypted-locker-nextjs && tsc --noEmit"
   }
 }