diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 92e4a71..68f53aa 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -25,7 +25,7 @@ jobs:
         java-version: "17"
         check-latest: false
     - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2
+      uses: gradle/gradle-build-action@v2.4.2
       with:
         dependency-graph: generate-and-submit
     - name: Setup Rust
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 0000000..e7a46e2
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,41 @@
+name: publish
+
+on:
+  # For convenience, run upon tagging a release.
+  release:
+    types:
+    - published
+  # This is mainly intended for snapshots.
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Setup Java
+      uses: actions/setup-java@v3
+      with:
+        distribution: temurin
+        java-version: "17"
+        check-latest: false
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v2.4.2
+    - name: Setup Rust
+      id: rust-toolchain
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
+    - name: Rust caching
+      uses: Swatinem/rust-cache@v2
+      with:
+        key: ${{ steps.rust-toolchain.outputs.cachekey }}
+        workspaces: divviup/rust
+    - name: Upload artifacts
+      env:
+        ORG_GRADLE_PROJECT_ossrhUsername: ${{ secrets.OSSRH_USERNAME }}
+        ORG_GRADLE_PROJECT_ossrhPassword: ${{ secrets.OSSRH_PASSWORD }}
+        ORG_GRADLE_PROJECT_signingKey: ${{ secrets.PGP_SIGNING_KEY }}
+        ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.PGP_SIGNING_PASSPHRASE }}
+      run: ./gradlew :divviup:publishReleasePublicationToOSSRHRepository
diff --git a/divviup/build.gradle.kts b/divviup/build.gradle.kts
index eb83afd..47a27d4 100644
--- a/divviup/build.gradle.kts
+++ b/divviup/build.gradle.kts
@@ -2,6 +2,7 @@ plugins {
     id("com.android.library")
     id("org.mozilla.rust-android-gradle.rust-android")
     id("maven-publish")
+    signing
 }
 
 android {
@@ -127,4 +128,37 @@ publishing {
             }
         }
     }
+
+    repositories {
+        maven {
+            name = "OSSRH"
+
+            val releasesRepoUrl = uri("https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/")
+            val snapshotsRepoUrl = uri("https://s01.oss.sonatype.org/content/repositories/snapshots/")
+            url = if (version.toString().endsWith("SNAPSHOT")) snapshotsRepoUrl else releasesRepoUrl
+
+            authentication {
+                register<BasicAuthentication>("basic")
+            }
+
+            credentials {
+                val ossrhUsername: String? by project
+                val ossrhPassword: String? by project
+                username = ossrhUsername
+                password = ossrhPassword
+            }
+        }
+    }
+}
+
+signing {
+    sign(publishing.publications["release"])
+
+    val signingKey: String? by project
+    val signingPassword: String? by project
+    if (signingKey != null && signingPassword != null) {
+        useInMemoryPgpKeys(signingKey, signingPassword)
+    } else {
+        useGpgCmd()
+    }
 }