diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44f0ea8..9997ecb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,8 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -40,3 +42,20 @@ jobs:
           MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
           MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
           SIGNINGPASSWORD: ${{ secrets.SIGNINGPASSWORD }}
+  github-release:
+    name: GitHub Release
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # gh release create
+    steps:
+      - name: Create GitHub Release
+        run: |
+          if gh release view "$GITHUB_REF_NAME" > /dev/null 2>&1; then
+            echo "::notice::GitHub Release $GITHUB_REF_NAME already exists, skipping"
+          else
+            gh release create "$GITHUB_REF_NAME" --verify-tag --title "$GITHUB_REF_NAME" --generate-notes --latest
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
diff --git a/AGENTS.md b/AGENTS.md
index 6f48b93..2bbd8f8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -65,7 +65,7 @@ make maven-deploy                  # mvn -Prelease clean deploy (CI only; needs
 
 CI:
 - `.github/workflows/build.yml`: Linux job runs `make test-go` + `make build-all` on Java 8. Matrix jobs run `make build-current-platform` on Windows/macOS with Java 11.
-- `.github/workflows/release.yml` and `snapshots.yml`: Linux Java 8; run `make build-all` then `make maven-deploy`.
+- `.github/workflows/release.yml` and `snapshots.yml`: Linux Java 8; run `make build-all` then `make maven-deploy`. `release.yml` then creates the GitHub Release for the tag in a separate `github-release` job.
 - Shared CI infra: `.github/actions/free-disk-space` (composite action) reclaims runner disk space before Ubuntu builds.
 
 ## Releasing (maintainer only)
@@ -75,7 +75,7 @@ Versioning is `0.0.X` patch-only; `main` always sits on `0.0-SNAPSHOT` (so `VS=0
 1. **Pre-flight**: be on `main`, clean tree, in sync with `origin`. Skim `git log v0.0.<X-1>..HEAD --oneline` to confirm the scope is patch-worthy.
 2. **Cut the release**: `make release V=0.0.X VS=0.0`. This sets the pom to `0.0.X`, commits, tags `v0.0.X`, **pushes the tag** (which triggers `release.yml`), then sets the pom back to `0.0-SNAPSHOT`, commits, and pushes `main`. Two commits land on `main` plus one tag.
 3. **Wait for `release.yml`**: ~20 min. `gh run watch <run-id> --exit-status` until it's green. It builds all 5 native binaries and runs `make maven-deploy` to Maven Central. If it fails partway, artifacts may be partially staged — don't re-run blindly, inspect first.
-4. **Create the GitHub Release manually**: `release.yml` only publishes to Maven Central; it does NOT cut a GitHub Release. On https://github.com/manusa/helm-java/releases/new pick the `v0.0.X` tag and click **Generate release notes** (this is what every prior release used — a PR list plus the `compare/v0.0.<X-1>...v0.0.X` link). Publish.
+4. **GitHub Release (automatic)**: once the `release` job's Maven deploy succeeds, the separate `github-release` job in `release.yml` (`needs: release`, the only job with `contents: write`) runs `gh release create v0.0.X --verify-tag --title v0.0.X --generate-notes --latest`. That gives the same format as every earlier release: a PR list plus the `compare/v0.0.<X-1>...v0.0.X` link. If the release already exists, the job skips. Check https://github.com/manusa/helm-java/releases. If only `github-release` failed, **Re-run failed jobs** re-runs just that job; it doesn't redeploy to Maven Central. **Fallback** (the re-run fails too, or the deploy was finished by hand): on https://github.com/manusa/helm-java/releases/new pick the `v0.0.X` tag, click **Generate release notes**, and publish, or run `gh release create v0.0.X --verify-tag --title v0.0.X --generate-notes --latest`.
 5. **Verify on Maven Central**: artifacts appear under https://central.sonatype.com/artifact/com.marcnuri.helm-java/helm-java within ~30 min of step 3 finishing.
 
 **Don't cancel running tests** that hit Kubernetes — they leak cluster resources.
diff --git a/README.md b/README.md
index e491f07..24c8346 100644
--- a/README.md
+++ b/README.md
@@ -888,7 +888,13 @@ To release a new version manually:
 
 #### Create GitHub Release
 
-Once the release is published to Maven Central, create a new [GitHub release](https://github.com/manusa/helm-java/releases/new) for the released tag.
+The `Release to Maven Central` workflow creates the GitHub release for the pushed tag after the Maven Central deployment succeeds. A separate `GitHub Release` job does this, with the tag as title, generated release notes, and the release marked latest. If the release already exists, the job skips.
+If only that job failed, use "Re-run failed jobs"; this re-runs just the GitHub Release job and does not redeploy to Maven Central.
+If the re-run fails too, or the deployment was finished by hand, create a new [GitHub release](https://github.com/manusa/helm-java/releases/new) for the released tag manually with "Generate release notes", or run:
+
+```shell
+gh release create vX.Y.Z --verify-tag --title vX.Y.Z --generate-notes --latest
+```
 
 ### License Headers