diff --git a/.github/workflows/gh_release.yml b/.github/workflows/gh_release.yml
new file mode 100644
index 00000000..66196d18
--- /dev/null
+++ b/.github/workflows/gh_release.yml
@@ -0,0 +1,31 @@
+name: Release
+on:
+  push:
+    tags: ["*"]
+jobs:
+  release:
+    concurrency: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: apt-get update
+        run: sudo apt-get update
+      - name: Set up JDK
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'temurin'
+          java-version: 21
+      - uses: actions/cache@v2
+        with:
+          path: |
+            ~/.sbt
+            ~/.coursier
+          key: ${{ runner.os }}-sbt-${{ hashfiles('**/build.sbt') }}
+      - run: sbt +test ciReleaseTagNextVersion
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: sbt ++3.4.1 publish
+        env:
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 27fff7d7..4101890f 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -20,3 +20,5 @@ jobs:
           key: ${{ runner.os }}-sbt-${{ hashfiles('**/build.sbt') }}
       - name: scalafmtCheck and tests
         run: sbt scalafmtCheck Test/scalafmtCheck test
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/build.sbt b/build.sbt
index 62d9117d..7a51489e 100644
--- a/build.sbt
+++ b/build.sbt
@@ -215,6 +215,17 @@ ThisBuild / compile / javacOptions ++= Seq(
 Global / cancelable           := true
 Global / onChangedBuildSource := ReloadOnSourceChanges
 
+githubOwner      := "Privado-Inc"
+githubRepository := "flatgraph"
+
+credentials +=
+  Credentials(
+    "GitHub Package Registry",
+    "maven.pkg.github.com",
+    "Privado-Inc",
+    sys.env.getOrElse("GITHUB_TOKEN", "N/A")
+  )
+
 ThisBuild / publishTo := sonatypePublishToBundle.value
 sonatypeCredentialHost := "s01.oss.sonatype.org"
 ThisBuild / scmInfo := Some(
diff --git a/project/plugins.sbt b/project/plugins.sbt
index 06c1884a..d5c8d3ee 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -3,3 +3,4 @@ addSbtPlugin("com.github.sbt"     % "sbt-native-packager"  % "1.9.16")
 addSbtPlugin("pl.project13.scala" % "sbt-jmh"              % "0.4.4")
 addSbtPlugin("com.github.sbt"     % "sbt-dynver"           % "5.0.1")
 addSbtPlugin("io.shiftleft"       % "sbt-ci-release-early" % "2.0.19")
+addSbtPlugin("com.codecommit"     % "sbt-github-packages"  % "0.5.3")
diff --git a/upstream_sync.sh b/upstream_sync.sh
new file mode 100644
index 00000000..82e28c5c
--- /dev/null
+++ b/upstream_sync.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+git remote add upstream https://github.com/joernio/flatgraph
+
+usage() {
+  echo "Usage: $0 [--publish]"
+  exit 1
+}
+
+PUBLISH=false
+while [[ "$#" -gt 0 ]]; do
+  case $1 in
+    --publish) PUBLISH=true ;;
+    *) usage ;;
+  esac
+  shift
+done
+
+git fetch upstream
+
+git checkout sync
+git merge upstream/master
+git push origin sync
+
+if [ "$PUBLISH" = true ]; then
+  git checkout master
+  git merge sync
+  git push origin master
+fi