diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
new file mode 100644
index 000000000..2ba18a2a4
--- /dev/null
+++ b/.github/workflows/tag-release.yml
@@ -0,0 +1,26 @@
+name: tag-release
+
+on:
+  push:
+    branches:
+      - master
+      - 'release-*'
+    paths:
+      - version.txt
+
+jobs:
+  tag-release:
+    if: ${{ github.repository == 'kubernetes-sigs/aws-iam-authenticator' }}
+    runs-on: ubuntu-20.04
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - run: /usr/bin/git config --global user.email actions@github.com
+      - run: /usr/bin/git config --global user.name 'GitHub Actions Release Tagger'
+      - run: hack/tag-release.sh
+
diff --git a/Makefile b/Makefile
index d33692589..9af26eee0 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@ default: bin/aws-iam-authenticator
 PKG ?= sigs.k8s.io/aws-iam-authenticator
 GORELEASER := $(shell command -v goreleaser 2> /dev/null)
 
-VERSION ?= v0.6.0
+VERSION ?= $(shell $(shell pwd)/hack/get-version.sh)
 GOOS ?= $(shell go env GOOS)
 GOARCH ?= $(shell go env GOARCH)
 GOPROXY ?= $(shell go env GOPROXY)
diff --git a/hack/get-version.sh b/hack/get-version.sh
new file mode 100755
index 000000000..9bd80861b
--- /dev/null
+++ b/hack/get-version.sh
@@ -0,0 +1,26 @@
+#!/bin/bash -xe
+
+# Copyright 2022 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+VERSION=$(cat version.txt)
+
+printerr() { echo "$@" 1>&2; }
+
+if [[ ! "${VERSION}" =~ ^([0-9]+[.][0-9]+)[.]([0-9]+)(-(alpha|beta)[.]([0-9]+))?$ ]]; then
+  printerr "Version ${VERSION} must be 'X.Y.Z', 'X.Y.Z-alpha.N', or 'X.Y.Z-beta.N'"
+  exit 1
+fi
+
+echo "v${VERSION}"
diff --git a/hack/tag-release.sh b/hack/tag-release.sh
new file mode 100644
index 000000000..5605b5048
--- /dev/null
+++ b/hack/tag-release.sh
@@ -0,0 +1,30 @@
+#!/bin/bash -xe
+
+# Copyright 2022 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+VERSION=$(cat version.txt)
+
+if [[ ! "${VERSION}" =~ ^([0-9]+[.][0-9]+)[.]([0-9]+)(-(alpha|beta)[.]([0-9]+))?$ ]]; then
+  echo "Version ${VERSION} must be 'X.Y.Z', 'X.Y.Z-alpha.N', or 'X.Y.Z-beta.N'"
+  exit 1
+fi
+
+if [ "$(git tag -l "v${VERSION}")" ]; then
+  echo "Tag v${VERSION} already exists"
+  exit 0
+fi
+
+git tag -a -m "Release ${VERSION}" "v${VERSION}"
+git push origin "v${VERSION}"
diff --git a/version.txt b/version.txt
new file mode 100644
index 000000000..4f965c885
--- /dev/null
+++ b/version.txt
@@ -0,0 +1 @@
+0.6.1-alpha.0