diff --git a/.github/workflows/jsonata.yml b/.github/workflows/jsonata.yml
index de073247..5c29ac60 100644
--- a/.github/workflows/jsonata.yml
+++ b/.github/workflows/jsonata.yml
@@ -1,12 +1,9 @@
-name: Build and publish JSONata
+name: Build JSONata
 on:
   push:
     branches: [ master, v1 ]
   pull_request:
     branches: [ master, v1 ]
-permissions:
-  id-token: write  # Required for OIDC
-  contents: read
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -22,21 +19,6 @@ jobs:
           node-version: ${{ matrix.node-version }}
       - run: npm install
       - run: npm test
-  publish:
-    needs: build
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'push' && github.repository == 'jsonata-js/jsonata' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Use Node.js 24.x
-        uses: actions/setup-node@v3
-        with:
-          node-version: 24.x
-      - name: Install and build
-        run: npm install && npm test
-      - name: Publish to NPM
-        run: npm publish
   documentation:
     needs: build    
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..60024ca8
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,26 @@
+name: Publish JSONata
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false  # never use caching in release builds
+      - name: Install and build
+        run: npm install && npm test
+      - name: Publish to NPM
+        run: npm publish