diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index daabcb1..1e07be1 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -8,6 +8,7 @@ jobs:
   detectonly:
     name: Detect use of .only
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v2
       - name: Detect use of .only
@@ -17,6 +18,7 @@ jobs:
   default:
     name: "Default"
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v4
@@ -43,6 +45,7 @@ jobs:
   asyncify:
     name: Asyncify
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v4
@@ -68,6 +71,7 @@ jobs:
   opfs:
     name: OPFS
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v4
@@ -98,6 +102,7 @@ jobs:
   opfs-sab-free:
     name: OPFS (SAB-free ASYNCIFY + JSPI + loader)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v4
@@ -147,6 +152,7 @@ jobs:
   package:
     name: "Package (tarball browser tests)"
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v4
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8bfacae..ffc9afc 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,12 +7,13 @@ on:
   push:
     branches: [ master ]
 permissions:
-  contents: read
+  contents: write # create the GitHub release + tag after a successful npm publish
   id-token: write
 jobs:
   default:
     name: "Publish"
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -20,6 +21,8 @@ jobs:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
       - name: Default
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           npm install
           sh setup.sh
@@ -50,6 +53,10 @@ jobs:
           # always does a dry-run, never a real publish.
           if [[ "$VERSION" != "$NEWVERSION" && "$GITHUB_EVENT_NAME" = "push" ]]; then
             npm publish --provenance --access public
+            # Announce the release on GitHub so watchers/stargazers are notified;
+            # notes are generated from the PRs merged since the previous tag.
+            gh release create "v$NEWVERSION" --target "$GITHUB_SHA" \
+              --title "v$NEWVERSION" --generate-notes
           elif [[ "$VERSION" != "$NEWVERSION" ]]; then
             echo "version change is $VERSION->$NEWVERSION, event is $GITHUB_EVENT_NAME, not publishing, only dry-run"
             npm publish --dry-run