diff --git a/.github/workflows/major-version-tag.yml b/.github/workflows/major-version-tag.yml
new file mode 100644
index 0000000..cd5113c
--- /dev/null
+++ b/.github/workflows/major-version-tag.yml
@@ -0,0 +1,30 @@
+name: Major version tag
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  retag:
+    if: "!github.event.release.prerelease"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Move major version tag
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Skipping: $TAG is not a vMAJOR.MINOR.PATCH tag"
+            exit 0
+          fi
+
+          major="${TAG%%.*}"
+          git tag -f "$major" "$TAG"
+          git push --force origin "$major"
diff --git a/RELEASING.md b/RELEASING.md
index c9740c3..d8b096a 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -11,12 +11,9 @@
 
 This action follows [Semantic Versioning]. The major version tag (e.g. `v1`) is kept pointing at the latest patch release in that series so consumers who pin `thoughtbot/importmap-update@v1` get updates automatically.
 
-After tagging `v1.x.x`, move the floating tag:
+The [Major version tag workflow](.github/workflows/major-version-tag.yml) moves it automatically when a non-prerelease release is published, so step 5 above is the last manual step.
 
-```
-git tag -f v1
-git push --force origin v1
-```
+Do not create a GitHub release for the `v1` tag. Releases in this repo are immutable, and attaching one would freeze the tag in place.
 
 [Semantic Versioning]: https://semver.org