diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e545428..4d9b3ba6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,10 @@ env:
   APP_NAME: ngrok
   MACOSX_DEPLOYMENT_TARGET: '10.13'
 on:
+  workflow_call:
+    secrets:
+      NGROK_AUTHTOKEN:
+        required: true
   push:
     branches:
       - '**'
@@ -505,63 +509,4 @@ jobs:
         with:
           name: bindings-universal-apple-darwin
           path: ${{ env.APP_NAME }}.*.node
-          if-no-files-found: error
-
-  publish:
-    if: github.ref == 'refs/heads/main' && github.repository == 'ngrok/ngrok-javascript'
-    name: Publish
-    runs-on: ubuntu-latest
-    needs:
-      - udeps
-      - fmt
-      - clippy
-      - build-freebsd
-      - test-windows-msvc-binding
-      - test-linux-x64-gnu-binding
-      - test-linux-x64-musl-binding
-      - test-linux-aarch64-gnu-binding
-      - test-linux-aarch64-musl-binding
-      - test-linux-arm-gnueabihf-binding
-      - universal-macOS
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 18
-          cache: yarn
-
-      - name: Install dependencies
-        run: yarn install
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Move artifacts
-        run: yarn artifacts
-
-      - name: List packages
-        run: ls -R ./npm
-        shell: bash
-
-      - name: Publish
-        run: |
-          echo "git log:"
-          git log -1 --pretty=%B
-          if git log -1 --pretty=%B | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+$";
-          then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --access public
-          elif git log -1 --pretty=%B | grep "^[0-9]\+\.[0-9]\+\.[0-9]\+";
-          then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --tag next --access public
-          else
-            echo "Not a release, skipping publish"
-          fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          if-no-files-found: error
\ No newline at end of file
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..02abcf52
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,81 @@
+name: Publish
+
+on:
+  workflow_dispatch:
+
+jobs:
+  ci:
+    name: Run CI checks
+    uses: ./.github/workflows/ci.yml
+    secrets:
+      NGROK_AUTHTOKEN: ${{ secrets.NGROK_AUTHTOKEN }}
+
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    needs: ci
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 18
+          cache: yarn
+
+      - name: Install dependencies
+        run: yarn install
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Move artifacts
+        run: yarn artifacts
+
+      - name: List packages
+        run: ls -R ./npm
+        shell: bash
+
+      - name: Publish
+        run: |
+          # extract version from Cargo.toml
+          version=$(grep '^version =' Cargo.toml | sed -E 's/version = "(.*)"/\1/')
+          echo "Package version: $version"
+
+          # npm auth
+          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
+
+          # check if version already exists, if not, publish it
+          if npm view "@ngrok/ngrok@${version}" > /dev/null 2>&1; then
+            echo "@ngrok/ngrok@${version} already exists on npm. Skipping publish."
+          elif [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Publishing release version $version"
+            npm publish --access public
+          elif [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+            echo "Publishing version $version with tag 'next'"
+            npm publish --tag next --access public
+          else
+            echo "Not a release, skipping publish"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Tag Release
+        run: |
+          git config user.name "GitHub Action"
+          git config user.email noreply@ngrok.com
+          version=$(grep '^version =' Cargo.toml | sed -E 's/version = "(.*)"/\1/')
+          tag="v$version"
+          echo "Tagging release: $tag"
+          echo "Fetching all tags in the repository"
+          git fetch --tags
+          if git rev-parse "$tag" > /dev/null 2>&1; then
+            echo "Tag $tag already exists, skipping tag creation."
+          else
+            echo "Tag $tag does not exist, pushing tag."
+            git tag -a -m "Version ${version}" $tag
+            git push --tags
+          fi
\ No newline at end of file