gh release create makes the tag through the API, so the job no longer
needs checkout credentials persisted.

Assisted-by: Claude Opus 5 via Claude Code
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 61b825c..75ce2b3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,12 +12,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      packages: write
+      contents: write # create the GitHub release and its tag.
+      packages: write # push the image to GHCR.
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Download Soju
         run: |
@@ -52,3 +54,13 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOJU_VERSION: ${{ github.event.inputs.version }}
+        run: |
+          gh release create "v$SOJU_VERSION" \
+            --target "$GITHUB_SHA" \
+            --title "v$SOJU_VERSION" \
+            --notes "Docker image for [soju v$SOJU_VERSION](https://codeberg.org/emersion/soju/releases/tag/v$SOJU_VERSION), published as ghcr.io/kejadlen/soju:$SOJU_VERSION."
diff --git a/README.md b/README.md
index d69f691..3236d75 100644
--- a/README.md
+++ b/README.md
@@ -23,5 +23,6 @@ Or manually via the GitHub Actions UI:
 3. Enter the soju version (e.g., `0.8.2`)
 4. Click "Run workflow"
 
-This will automatically build and publish the Docker image to
-`ghcr.io/kejadlen/soju` with the specified version tag.
+This builds and publishes the Docker image to `ghcr.io/kejadlen/soju`
+with the specified version tag, then creates a matching `v`-prefixed
+GitHub release.