diff --git a/.github/workflows/zarr-metadata-release.yml b/.github/workflows/zarr-metadata-release.yml
new file mode 100644
index 0000000000..f317ad729d
--- /dev/null
+++ b/.github/workflows/zarr-metadata-release.yml
@@ -0,0 +1,114 @@
+name: zarr-metadata release
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build wheel and sdist
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: packages/zarr-metadata
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0          # hatch-vcs needs full history + tags
+
+      - name: Install Hatch
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+        with:
+          version: '1.16.5'
+
+      - name: Build
+        run: hatch build
+
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: zarr-metadata-dist
+          path: packages/zarr-metadata/dist
+
+  test_artifacts:
+    name: Test built artifacts
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: zarr-metadata-dist
+          path: dist
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Install built wheel and run import smoke test
+        run: |
+          wheel=$(ls dist/*.whl)
+          uv run --with "${wheel}" --python 3.12 --no-project \
+            python -c "import zarr_metadata"
+
+  upload_pypi:
+    name: Upload to PyPI
+    needs: [build, test_artifacts]
+    if: github.event_name == 'release' && startsWith(github.event.release.tag_name, 'zarr_metadata/')
+    runs-on: ubuntu-latest
+    environment:
+      name: zarr-metadata-releases
+      url: https://pypi.org/p/zarr-metadata
+    permissions:
+      id-token: write          # required for OIDC trusted publishing
+      attestations: write      # required for artifact attestations
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: zarr-metadata-dist
+          path: dist
+
+      - name: Generate artifact attestation
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: dist/*
+
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+
+  upload_testpypi:
+    name: Upload to TestPyPI
+    needs: [build, test_artifacts]
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    environment:
+      name: zarr-metadata-releases-test
+      url: https://test.pypi.org/p/zarr-metadata
+    permissions:
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: zarr-metadata-dist
+          path: dist
+
+      - name: Generate artifact attestation
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: dist/*
+
+      - name: Publish package to TestPyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        with:
+          repository-url: https://test.pypi.org/legacy/
diff --git a/packages/zarr-metadata/pyproject.toml b/packages/zarr-metadata/pyproject.toml
index f24d1ae206..8f83c289f4 100644
--- a/packages/zarr-metadata/pyproject.toml
+++ b/packages/zarr-metadata/pyproject.toml
@@ -1,10 +1,10 @@
 [build-system]
-requires = ["hatchling>=1.29.0"]
+requires = ["hatchling>=1.29.0", "hatch-vcs"]
 build-backend = "hatchling.build"
 
 [project]
 name = "zarr-metadata"
-version = "0.1.0"
+dynamic = ["version"]
 description = "Spec-defined metadata types for Zarr v2 and v3."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -32,6 +32,14 @@ dependencies = [
 [dependency-groups]
 test = ["pytest", "pydantic>=2"]
 
+[tool.hatch.version]
+source = "vcs"
+tag-pattern = '^zarr_metadata/v(?P<version>.+)$'
+# `git_describe_command` ensures we get the zarr_metadata tags instead of latest.
+# `local_scheme` strips the git commit info so the appending info is just a counter from latest tag.
+# test-pypi doesn't accept git commit info in tags, and the count should be enough to distinguish unique runs.
+raw-options = { root = "../..", git_describe_command = "git describe --dirty --tags --long --match zarr_metadata/v*", local_scheme = "no-local-version" }
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/zarr_metadata"]
 
diff --git a/packages/zarr-metadata/tests/test_version.py b/packages/zarr-metadata/tests/test_version.py
deleted file mode 100644
index 86b177963b..0000000000
--- a/packages/zarr-metadata/tests/test_version.py
+++ /dev/null
@@ -1,16 +0,0 @@
-"""Verify that `zarr_metadata.__version__` matches the installed
-distribution metadata, which in turn comes from `pyproject.toml`.
-
-This catches the easy mistake of bumping the version in one place and
-forgetting the other.
-"""
-
-from __future__ import annotations
-
-from importlib.metadata import version
-
-import zarr_metadata
-
-
-def test_version_matches_distribution_metadata() -> None:
-    assert zarr_metadata.__version__ == version("zarr-metadata")