diff --git a/.bcr/metadata.template.json b/.bcr/metadata.template.json
new file mode 100644
index 0000000..28a41d1
--- /dev/null
+++ b/.bcr/metadata.template.json
@@ -0,0 +1,16 @@
+{
+  "homepage": "https://github.com/hermeticbuild/rules_runfiles_group",
+  "maintainers": [
+    {
+      "name": "Malte Poll",
+      "email": "1780588+malt3@users.noreply.github.com",
+      "github": "malt3",
+      "github_user_id": 1780588
+    }
+  ],
+  "repository": [
+    "github:hermeticbuild/rules_runfiles_group"
+  ],
+  "versions": [],
+  "yanked_versions": {}
+}
diff --git a/.bcr/presubmit.yml b/.bcr/presubmit.yml
new file mode 100644
index 0000000..bf38337
--- /dev/null
+++ b/.bcr/presubmit.yml
@@ -0,0 +1,12 @@
+bcr_test_module:
+  module_path: "example"
+  matrix:
+    platform: ["debian11", "macos", "ubuntu2204"]
+    bazel: [7.x, 8.x, 9.x]
+  tasks:
+    run_tests:
+      name: "Run test module"
+      platform: ${{ platform }}
+      bazel: ${{ bazel }}
+      test_targets:
+        - "//..."
diff --git a/.bcr/source.template.json b/.bcr/source.template.json
new file mode 100644
index 0000000..e87efc3
--- /dev/null
+++ b/.bcr/source.template.json
@@ -0,0 +1,6 @@
+{
+  "integrity": "**leave this alone**",
+  "strip_prefix": "{REPO}-{VERSION}",
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/rules_runfiles_group-{TAG}.tar.gz",
+  "docs_url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/rules_runfiles_group-{TAG}.docs.tar.gz"
+}
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..9faef8b
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+# Exclude dev directories from release archives
+.docextract export-ignore
+.bcr export-ignore
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..0ec8959
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,35 @@
+# Publish new releases to Bazel Central Registry.
+name: Publish to BCR
+on:
+  # Run the publish workflow after a successful release.
+  # Will be triggered from the release.yml workflow.
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      publish_token:
+        required: true
+  # In case of problems, let release engineers retry by manually dispatching
+  # the workflow from the GitHub UI.
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: git tag being released
+        required: true
+        type: string
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.2.0
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      registry_fork: hermeticbuild/bazel-central-registry
+      draft: false
+      attest: true
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..3ca352b
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,25 @@
+# Cut a release whenever a new tag is pushed to the repo.
+name: Release
+on:
+  # Or, developers can manually push a tag from their clone
+  push:
+    tags:
+      - "v*.*.*"
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+jobs:
+  release:
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
+    with:
+      release_files: rules_runfiles_group-*.tar.gz
+      prerelease: false
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish.yml
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    secrets:
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
new file mode 100755
index 0000000..61cc7d3
--- /dev/null
+++ b/.github/workflows/release_prep.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+
+# Argument provided by reusable workflow caller, see
+# https://github.com/bazel-contrib/.github/blob/d197a6427c5435ac22e56e33340dff912bc9334e/.github/workflows/release_ruleset.yaml#L72
+TAG=$1
+# The prefix is chosen to match what GitHub generates for source archives.
+# This guarantees that users can easily switch from a released artifact to a source archive
+# with minimal differences in their code (e.g. strip_prefix remains the same).
+PREFIX="rules_runfiles_group-${TAG:1}"
+ARCHIVE="rules_runfiles_group-$TAG.tar.gz"
+
+# NB: configuration for 'git archive' is in /.gitattributes
+git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE
+
+# Add generated API docs to the release, see https://github.com/bazelbuild/bazel-central-registry/issues/5593
+docs="$(mktemp -d)"; targets="$(mktemp)"
+bazel --output_base="$docs" query --output=label --output_file="$targets" 'kind("starlark_doc_extract rule", //.docextract/...)'
+bazel --output_base="$docs" build --target_pattern_file="$targets"
+tar --create --auto-compress \
+    --directory "$(bazel --output_base="$docs" info bazel-bin)" \
+    --file "$GITHUB_WORKSPACE/${ARCHIVE%.tar.gz}.docs.tar.gz" .
+
+cat << EOF
+## Add to your \`MODULE.bazel\` file:
+
+\`\`\`starlark
+bazel_dep(name = "rules_runfiles_group", version = "${TAG:1}")
+\`\`\`
+
+EOF