diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..9c9ca41
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,80 @@
+name: Publish to NPM
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    environment: deploy
+    if: github.repository == 'ton-org/blueprint'
+
+    permissions:
+      contents: read
+      id-token: write # required for npm provenance when publishing with trusted publishing.
+
+    steps:
+      - name: Fetch Sources
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Check package version
+        # language=Bash
+        run: |
+          package_version="$(jq -r .version package.json)"
+          tag_version="${GITHUB_REF_NAME#v}"
+
+          if [ "$tag_version" != "$package_version" ]; then
+            echo "::error title=Version mismatch::package.json(version) '${package_version}' does not match tag '${tag_version}'"
+            exit 1
+          fi
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: yarn install --immutable --check-cache --check-resolutions
+
+      - name: Build
+        run: yarn run build
+
+      - name: Publish
+        run: npm publish --access public
+
+  release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    needs: publish
+    if: github.repository == 'ton-org/blueprint'
+
+    permissions:
+      contents: write # required to create the GitHub Release for the published tag.
+
+    steps:
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        # language=Bash
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "$GITHUB_REF_NAME" \
+            --generate-notes \
+            --verify-tag
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
deleted file mode 100644
index c501064..0000000
--- a/.github/workflows/publish.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-on:
-  push:
-    branches:
-      - main
-      - develop
-
-name: Publish to NPM
-jobs:
-  publish:
-    name: Publish
-    runs-on: ubuntu-latest
-    environment: ${{ github.ref_name == 'main' && 'prod' || 'dev' }}
-
-    permissions:
-      contents: read
-      id-token: write
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Enable Corepack
-        run: corepack enable
-
-      - name: Use Node.js 18
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: yarn install
-
-      - name: Bump version (dev)
-        if: github.ref_name == 'develop'
-        id: version
-        run: |
-          CURRENT_VERSION=$(jq -r '.version' package.json)
-          BASE_VERSION=$(echo $CURRENT_VERSION | cut -d '-' -f 1)
-          
-          NEW_BASE=$(echo $BASE_VERSION | awk -v OFS='.' -F. '{
-            $2 = $2 + 1;
-            $3 = 0;
-            print $0
-          }')
-          
-          TIMESTAMP=$(date -u +"%Y%m%d%H%M%S")
-          COMMIT_SHA=$(git rev-parse --short HEAD)
-          NEW_VERSION="${NEW_BASE}-dev.${TIMESTAMP}.${COMMIT_SHA}"
-          
-          jq ".version = \"$NEW_VERSION\"" package.json > package.tmp
-          mv package.tmp package.json
-
-      - name: Build
-        run: yarn run build
-
-      - name: Publish
-        run: |
-          npm config delete //registry.npmjs.org/:_authToken || true
-          if [ "${{ github.ref_name }}" = "develop" ]; then
-            npm publish --provenance --access public --tag dev
-          else
-            npm publish --provenance --access public
-          fi
diff --git a/.github/workflows/qa.yaml b/.github/workflows/qa.yaml
index 8155bc7..01961a4 100644
--- a/.github/workflows/qa.yaml
+++ b/.github/workflows/qa.yaml
@@ -9,8 +9,7 @@ on:
       - '*.md'
       - '*.svg'
     branches:
-      - main
-      - develop
+      - master
   pull_request:
     paths-ignore:
       - '.github/workflows/publish.yml'
@@ -19,9 +18,7 @@ on:
       - '*.md'
       - '*.svg'
     branches:
-      - main
-      - develop
-
+      - master
 jobs:
   lint:
     name: Lint