diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d8f7e1..8d0e604 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ on:
       - master
 
 jobs:
-  redact_ex:
+  test:
     # runs-on: [self-hosted, k8s-medium]
     runs-on: ubuntu-latest
     env:
@@ -71,12 +71,49 @@ jobs:
         run: mix test
       - name: Dialyzer
         run: mix dialyzer
-         
+
+  publish:
+    name: Publish to hex.pm
+    needs: test
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup Elixir
+        uses: erlef/setup-beam@v1
+        # TODO optimize here to be in sync with the matrix above?
+        with:
+          otp-version: 25.0.4
+          elixir-version: 1.14.3
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: setup hex
+        run: |
+          mix mix local.hex --force
+          mix local.rebar --force
+      - name: get deps
+        run: mix deps.get
+      - name: get tag
+        run: |
+          REDACT_EX_VERSION_REPO=$(grep -m1 version mix.exs | cut -d'"' -f2)
+          echo "REDACT_EX_VERSION_REPO=$REDACT_EX_VERSION_REPO" >> $GITHUB_ENV
+      - name: check tags
+        if: github.ref_tag != ${{ env.REDACT_EX_VERSION_REPO }}
+        run: |
+          echo "Github ref tag [${{ github.ref_tag }}] is different from mix.exs version [${{ env.REDACT_EX_VERSION_REPO }}]"
+          exit 1
+      - name: Login to hex.pm
+        run: |
+          mix hex.config api_key "$HEX_AUTH_KEY"
+        env:
+          HEX_AUTH_KEY: ${{ secrets.HEX_AUTH_KEY }}
+      - name: Publish
+        run: mix hex.publish --yes
+
   alls-green:
     if: always()
-          
     needs:
-      - redact_ex
+      - test
+      - publish
     # runs-on: [self-hosted, k8s-small]
     runs-on: ubuntu-latest
     container: