diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
new file mode 100644
index 0000000..1a207a3
--- /dev/null
+++ b/.github/workflows/tag-release.yml
@@ -0,0 +1,36 @@
+# When a release commit created by create-release.yml is landed, create the
+# corresponding tag.
+name: Create release tag
+
+on:
+  push:
+    paths: [ emscripten-releases-tags.json, .github/workflows/tag-release.yml ]
+  workflow_dispatch:
+
+jobs:
+    tag-release:
+      # Only activate for commits created by the create-release.yml workflow.
+      # The assumption is that when manual changes happen, we want to handle
+      # tagging manually too.
+      if: github.event.head_commit.author.username == 'github-actions[bot]'
+      runs-on: ubuntu-latest
+      steps:
+        - name: Match message and create tag
+          uses: actions/github-script@v7
+          with:
+            script: |
+              const message = `${{ github.event.head_commit.message }}`
+              const regex = /Release ([0-9]+.[0-9]+.[0-9]+)/
+              const match = message.match(regex)
+              if (match) {
+                const release = match[1]
+                console.log(`Matched release ${release}`)
+                await github.rest.git.createRef({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  ref: `refs/tags/${release}`,
+                  sha: context.sha
+                })
+              } else {
+                console.log(`Commit message: ${message} did not match pattern`)
+              }