diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..5941325
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,49 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      # Gạch chắn: test đỏ thì mọi step sau không chạy (AC "test đỏ chặn đóng gói").
+      - name: Test
+        run: dotnet test PdfReaderApp.slnx -c Release
+
+      - name: Install winapp CLI
+        uses: microsoft/setup-WinAppCli@v0.2
+
+      - name: Pack MSIX
+        shell: pwsh
+        run: |
+          $version = "${{ github.ref_name }}".TrimStart("v")
+          ./pack-msix.ps1 -Version $version
+
+      - name: Upload MSIX artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: msix
+          path: PdfReaderApp_*.msix
+          if-no-files-found: error
+
+      - name: Create GitHub Release
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $version = "${{ github.ref_name }}".TrimStart("v")
+          gh release create "${{ github.ref_name }}" "PdfReaderApp_$version.msix" --generate-notes --verify-tag
diff --git a/pack-msix.ps1 b/pack-msix.ps1
index 4f7bed9..3e75283 100644
--- a/pack-msix.ps1
+++ b/pack-msix.ps1
@@ -30,12 +30,7 @@ if (Test-Path "Assets") {
 }
 
 Write-Host "Packaging MSIX..."
-# Generate a dummy dev cert if we don't have one for testing? Ticket says:
-# "Given dev cert self-signed đã cài (một lần). When cài file .msix vừa build và mở app. Then app khởi động..."
-# So the script should probably use --generate-cert or require a cert? 
-# Wait, winapp package has --generate-cert. Let's just create the msix without signing, or with a dummy cert?
-# Actually, the user says "dev cert self-signed đã cài". This means the cert is generated elsewhere or I can use --generate-cert and --install-cert here if they want? 
-# Let's generate a cert if it doesn't exist.
+# Cert dev chỉ để cài local khi smoke test; bản Store được Microsoft re-sign nên cert này không theo package (ADR 0005).
 if (-not (Test-Path "devcert.pfx")) {
     Write-Host "Generating devcert.pfx for testing..."
     winapp cert generate --output devcert.pfx --password password --publisher "CN=Placeholder"