diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..04d4552
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+updates:
+- package-ecosystem: pip
+  directory: "/"
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 50
+  target-branch: main
+  labels:
+  - dependency_updates
+  rebase-strategy: "disabled"
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: daily
+    time: "05:33"
+  target-branch: main
+  labels:
+  - CI
diff --git a/.github/utils/release_tag.msg.txt b/.github/utils/release_tag.msg.txt
new file mode 100644
index 0000000..dc8b0cb
--- /dev/null
+++ b/.github/utils/release_tag.msg.txt
@@ -0,0 +1,3 @@
+TAG_NAME
+
+The full release changelog can be seen in the [online docs](https://matgenix.github.io/atomate2-turbomole/changelog) and in the [repository source file](https://github.com/matgenix/atomate2-turbomole/blob/TAG_NAME/CHANGELOG.md).
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..9b9325e
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,143 @@
+name: Publish and Deploy
+
+on:
+  release:
+    types:
+    - published
+
+env:
+  PUBLISH_UPDATE_BRANCH: main
+  GIT_USER_NAME: Matgenix
+  GIT_USER_EMAIL: "dev@matgenix.com"
+
+jobs:
+
+  publish:
+    name: Publish package
+    runs-on: ubuntu-latest
+    if: github.repository == 'matgenix/atomate2-turbomole' && startsWith(github.ref, 'refs/tags/v')
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: true
+        fetch-depth: 0
+        ref: ${{ env.PUBLISH_UPDATE_BRANCH }}
+
+    - name: Set up Python 3.11
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+
+    - name: Install Python dependencies
+      run: |
+        python -m pip install -U pip
+        pip install -U setuptools wheel
+        pip install -r requirements/requirements.txt
+        pip install -e .[docs]
+
+    - name: Update changelog
+      uses: CharMixer/auto-changelog-action@v1
+      with:
+        token: ${{ secrets.RELEASE_PAT_BOT }}
+        release_branch: ${{ env.PUBLISH_UPDATE_BRANCH }}
+        exclude_labels: "duplicate,question,invalid,wontfix,dependency_updates,skip_changelog"
+
+    - name: Configure git and commit CHANGELOG
+      run: |
+        git config --global user.email "${GIT_USER_EMAIL}"
+        git config --global user.name "${GIT_USER_NAME}"
+        git commit CHANGELOG.md -m "Release ${GITHUB_REF#refs/tags/}"
+
+    - name: Move tag to new HEAD
+      run: |
+        TAG_MSG=.github/utils/release_tag_msg.txt
+        sed -i "s|TAG_NAME|${GITHUB_REF#refs/tags/}|" "${TAG_MSG}"
+        git tag -af -F "${TAG_MSG}" ${GITHUB_REF#refs/tags/}
+
+    - name: Update '${{ env.PUBLISH_UPDATE_BRANCH }}'
+      uses: CasperWA/push-protected@v2
+      with:
+        token: ${{ secrets.RELEASE_PAT_BOT }}
+        branch: ${{ env.PUBLISH_UPDATE_BRANCH }}
+        unprotect_reviews: true
+        sleep: 15
+        force: true
+        tags: true
+
+    - name: Install docs dependencies
+      run: |
+        # Required to generate rst files from markdown
+        sudo apt install pandoc
+
+    - name: Build Sphinx docs
+      working-directory: doc
+      run: |
+        # cannot use sphinx build directly as the makefile handles generation
+        # of some rst files
+        make html
+
+    - name: Fix permissions # following https://github.com/actions/upload-pages-artifact?tab=readme-ov-file#file-permissions
+      run: |
+        chmod -c -R +rX "./doc/build" | while read line; do
+          echo "::warning title=Invalid file permissions automatically fixed::$line"
+        done
+
+    - name: Upload docs artifact
+      uses: actions/upload-pages-artifact@v3
+      with:
+        path: ./doc/build/html
+
+    - name: Get tagged versions
+      run: echo "PREVIOUS_VERSION=$(git tag -l --sort -version:refname | sed -n 2p)" >> $GITHUB_ENV
+
+    - name: Create release-specific changelog
+      uses: CharMixer/auto-changelog-action@v1
+      with:
+        token: ${{ secrets.RELEASE_PAT_BOT }}
+        release_branch: ${{ env.PUBLISH_UPDATE_BRANCH }}
+        since_tag: "${{ env.PREVIOUS_VERSION }}"
+        output: "release_changelog.md"
+        exclude_labels: "duplicate,question,invalid,wontfix,dependency_updates,CI,skip_changelog"
+
+    - name: Append changelog to release body
+      run: |
+        gh api /repos/${{ github.repository }}/releases/${{ github.event.release.id }} --jq '.body' > release_body.md
+        cat release_changelog.md >> release_body.md
+        gh api /repos/${{ github.repository }}/releases/${{ github.event.release.id }} -X PATCH -F body='@release_body.md'
+      env:
+        GITHUB_TOKEN: ${{ secrets.RELEASE_PAT_BOT }}
+
+    - name: Build source distribution
+      run: |
+        pip install -U build
+        python -m build
+
+    - name: Publish package to Test PyPI first
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        user: __token__
+        password: ${{ secrets.TEST_PYPI_PASSWORD }}
+        repository-url: https://test.pypi.org/legacy/
+
+    - name: Publish package to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        user: __token__
+        password: ${{ secrets.PYPI_PASSWORD }}
+
+  deploy_docs:
+    if: github.repository == 'matgenix/atomate2-turbomole' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write      # to deploy to Pages
+      id-token: write   # to verify the deployment originates from an appropriate source
+    needs: publish
+    environment:
+      name: "Documentation"
+      url: https://matgenix.github.io/atomate2-turbomole
+
+    steps:
+    - name: Deploy docs
+      uses: actions/deploy-pages@v4
diff --git a/requirements/README.md b/requirements/README.md
new file mode 100644
index 0000000..fa7ff11
--- /dev/null
+++ b/requirements/README.md
@@ -0,0 +1,9 @@
+# Strict requirements
+
+These files contain pinned direct dependencies for use in testing, monitored by
+dependabot to ensure version upgrades compatible with `pyproject.toml` do not
+break the released version.
+
+In cases where dependabot updates a requirements file and the tests no longer
+pass, this may indicate that the supported versions in `pyproject.toml` need to
+be upgraded (and a release made).
diff --git a/requirements/requirements.txt b/requirements/requirements.txt
new file mode 100644
index 0000000..0aeb974
--- /dev/null
+++ b/requirements/requirements.txt
@@ -0,0 +1,5 @@
+pymatgen==2024.3.1
+custodian==2024.3.12
+jobflow==0.1.17
+emmet-core==0.80.0
+turbomoleio==1.4.0