diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0900897..65d0b1d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -44,6 +44,10 @@ jobs:
             echo "Run 'just sync-readme' to fix."
             exit 1
           }
+          grep -qx "## $VERSION" CHANGELOG.md || {
+            echo "CHANGELOG.md has no '## $VERSION' section"
+            exit 1
+          }
 
   tag-release:
     runs-on: ubuntu-latest
@@ -54,15 +58,32 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Tag version from pyproject.toml
-        run: |-
+        id: tag
+        run: |
           VERSION=$(grep '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
           TAG="v$VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           if git ls-remote --exit-code --tags origin "refs/tags/$TAG" > /dev/null; then
             echo "Tag $TAG already exists, skipping"
+            echo "created=false" >> "$GITHUB_OUTPUT"
           else
             git config user.name 'github-actions[bot]'
             git config user.email 'github-actions[bot]@users.noreply.github.com'
             git tag "$TAG"
             git push origin "$TAG"
             echo "Tagged $TAG"
+            echo "created=true" >> "$GITHUB_OUTPUT"
           fi
+      # Release notes are the CHANGELOG.md section for this version, from its
+      # heading up to the next heading.
+      - name: Publish GitHub release
+        if: steps.tag.outputs.created == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.tag.outputs.version }}
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |-
+          awk -v v="$VERSION" '$0 == "## " v {p=1; next} /^## /{p=0} p' CHANGELOG.md > notes.md
+          test -s notes.md || { echo "CHANGELOG.md has no '## $VERSION' section"; exit 1; }
+          gh release create "$TAG" --title "$TAG" --notes-file notes.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..dd37844
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,43 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+Releases follow semantic versioning as described in [DEVELOPING.md](./DEVELOPING.md).
+
+## 2.6.0
+
+New hooks for Go and the web stack.
+Minor bump: new checks, no removals, and existing hooks keep their behavior.
+
+### Added
+
+- `polymath-go`: formats Go with gofumpt and goimports, lints with golangci-lint's standard set plus errorlint, misspell, revive, and unconvert, and checks that staged `go.mod` and `go.sum` are tidy.
+  Requires Go 1.23 or newer on `PATH`.
+  golangci-lint is downloaded on first use into the hook's own virtualenv, verified against pinned checksums.
+- `polymath-javascript`: runs ESLint with `--fix` and then Prettier on JavaScript, JSX, TypeScript, and TSX.
+  The rule set is `eslint:recommended`, typescript-eslint recommended, and React, React Hooks, and jsx-a11y rules for JSX/TSX files, with Prettier defaults for formatting.
+  Next.js and Storybook rules are opt-in via `--framework next` and `--framework storybook`.
+- `polymath-css`: runs Stylelint with `--fix` and then Prettier on CSS and SCSS, using `stylelint-config-standard` and `stylelint-config-standard-scss`.
+- `polymath-html`: formats HTML with Prettier.
+- `polymath-copyright` inserts and validates `//` style headers in Go, JavaScript, JSX, TypeScript, and TSX files.
+
+### Changed
+
+- Node.js is bundled as a Python dependency.
+  The npm packages for the web hooks are installed once per hook revision on first use, and only when a web hook runs.
+- Prettier ignores a consuming repo's `.editorconfig` and honors its `.gitignore` and `.prettierignore`.
+- Checker configuration files live beside each checker in per-checker subpackages.
+
+### Fixed
+
+- The release tagging job no longer fails the workflow on merges that do not bump the version.
+- `--relicense` on the copyright hook preserves Go `//go:build` and `// +build` directives.
+
+### Upgrading
+
+Add the new hook ids to `.pre-commit-config.yaml` as needed.
+Repos using `polymath-copyright` with Go or web files will get headers inserted on the first run.
+Stage the results and commit again.
+
+## 2.5.0 and earlier
+
+See the [GitHub releases](https://github.com/polymathrobotics/polymath_code_standard/releases).
diff --git a/DEVELOPING.md b/DEVELOPING.md
index 5ec520c..290f954 100644
--- a/DEVELOPING.md
+++ b/DEVELOPING.md
@@ -20,8 +20,10 @@ To bump the version, use `just bump` -- it updates `pyproject.toml` and syncs th
 just bump minor   # or major / patch
 ```
 
-CI will fail on PRs where the two are out of sync.
-The tag is pushed automatically by CI on merge to main.
+Then add a `## <version>` section to `CHANGELOG.md` describing the release.
+
+CI fails PRs where the README pin or the changelog section is missing for the version in `pyproject.toml`.
+On merge to main, CI pushes the tag and publishes a GitHub release whose notes are that changelog section.
 
 ## Testing
 
diff --git a/README.md b/README.md
index 162e32c..7ef8a99 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@ Use only the hooks that apply to your project.
 ---
 repos:
   - repo: https://github.com/polymathrobotics/polymath_code_standard
-    rev: v2.5.0
+    rev: v2.6.0
     hooks:
       # File hygiene for all staged files
       - id: polymath-general
diff --git a/pyproject.toml b/pyproject.toml
index 96bb0e7..4cd7674 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "polymath-code-standard"
-version = "2.5.0"
+version = "2.6.0"
 description = "Polymath Code Standard pre-commit hooks"
 requires-python = ">=3.10"
 dependencies = [
diff --git a/uv.lock b/uv.lock
index e4239ff..cf0fb7b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -829,7 +829,7 @@ wheels = [
 
 [[package]]
 name = "polymath-code-standard"
-version = "2.5.0"
+version = "2.6.0"
 source = { editable = "." }
 dependencies = [
     { name = "ansible-lint" },