diff --git a/.github/workflows/push.yml b/.github/workflows/ci.yml
similarity index 53%
rename from .github/workflows/push.yml
rename to .github/workflows/ci.yml
index 5fb1b16..64fef1e 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,5 @@
-name: CI/CD
+name: CI
+
 on:
   push:
     branches:
@@ -7,7 +8,6 @@ on:
 
 jobs:
   test:
-    name: Test
     runs-on: ubuntu-latest
     services:
       mongo:
@@ -17,18 +17,18 @@ jobs:
     steps:
       - name: Checkout (push)
         if: ${{ github.event_name == 'push' }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       # Separate checkout action for pull_request_target, which needs to
       # explicitly checkout the SHA
       - name: Checkout (pull request)
         if: ${{ github.event_name == 'pull_request_target' }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
-          node-version: '20.9'
+          node-version: '20.x'
       - name: Install
         run: npm install
       - name: Lint
@@ -37,7 +37,24 @@ jobs:
         run: npm run build
       - name: test
         run: npm run test
-      - name: Tag
-        if: |
-          github.event_name == 'push' && github.ref == 'refs/heads/master'
-        run: ./tag.sh
+
+  release:
+    needs:
+    - test
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '20.x'
+        registry-url: 'https://npm.pkg.github.com'
+    - name: Install
+      run: npm install
+    - name: Build
+      run: npm run build
+    - name: Release
+      run: ./release.sh
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
deleted file mode 100644
index 07c8ea6..0000000
--- a/.github/workflows/publish.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: Publish
-
-on:
-  push:
-    tags:
-    - '*'
-
-jobs:
-  build:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-node@v3
-      with:
-        node-version: '20.9'
-        registry-url: 'https://npm.pkg.github.com'
-    - name: Install
-      # Skip post-install to avoid malicious scripts stealing PAT
-      run: npm install --ignore-script
-      env:
-        # GITHUB_TOKEN can't access packages hosted in private repos,
-        # even within the same organisation
-        NODE_AUTH_TOKEN: ${{ secrets.REEDSY_BOT_PERSONAL_ACCESS_TOKEN }}
-    - name: Post-install
-      run: npm rebuild && npm run prepare --if-present
-    - name: Build
-      run: npm run build
-    - name: Publish
-      run: npm publish
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/tag.sh b/release.sh
similarity index 97%
rename from tag.sh
rename to release.sh
index a24e4c5..679c4d4 100755
--- a/tag.sh
+++ b/release.sh
@@ -23,3 +23,5 @@ git add --all lib/
 git commit --message "Release version $VERSION"
 git tag $VERSION
 git push origin refs/tags/$VERSION
+
+npm publish