diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ed37128ca..2f2e7792e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,7 @@ on:
         type: boolean
         required: false
         description: Force rebuild
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-22.04
@@ -28,7 +29,9 @@ jobs:
       - uses: actions/cache@v3
         id: cache
         with:
-          path: lib
+          path: |
+            lib
+            versions.json
           key: ${{ steps.gen-cache-key.outputs.key }}
       - name: Build
         if: steps.cache.outputs.cache-hit != 'true'
@@ -36,29 +39,28 @@ jobs:
           docker build -t wasm-vips .
           docker run --rm -v ${{ github.workspace }}:/src wasm-vips
   CI:
-    runs-on: ${{ matrix.os }}
     needs: build
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
           - os: ubuntu-22.04
             nodejs_version: 16
-            publish: true
           - os: macos-11
             nodejs_version: 16
           - os: windows-2022
             nodejs_version: 16
     steps:
       - uses: actions/checkout@v4
-      - name: Setup node
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.nodejs_version }}
-          registry-url: 'https://registry.npmjs.org'
       - uses: actions/cache/restore@v3
         with:
-          path: lib
+          path: |
+            lib
+            versions.json
           key: ${{ needs.build.outputs.cache-key }}
           enableCrossOsArchive: true
           fail-on-cache-miss: true
@@ -68,11 +70,32 @@ jobs:
         run: npm --prefix test/unit install
       - name: Test
         run: npm test
+  release:
+    if: github.ref_type == 'tag'
+    needs:
+      - build
+      - CI
+    permissions:
+      contents: write # for gh release create
+      id-token: write # for npm publish --provenance
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+      - uses: actions/cache/restore@v3
+        with:
+          path: |
+            lib
+            versions.json
+          key: ${{ needs.build.outputs.cache-key }}
+          fail-on-cache-miss: true
       - name: Publish
-        if: matrix.publish && github.ref_type == 'tag'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npm publish
+          npm publish --provenance
           gh release create ${{ github.ref_name }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2b33077a2..1edfd3792 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@ All notable changes to wasm-vips will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [v0.0.6] - TBD
+## [v0.0.6] - 2023-11-11
 
 Uses libvips v8.15.0, compiled with Emscripten v3.1.48.
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 149c6a5a5..f48f56ce1 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -2,7 +2,7 @@
 cmake_minimum_required(VERSION 3.13)
 
 project(wasm-vips
-        VERSION 0.0.5
+        VERSION 0.0.6
         DESCRIPTION "libvips for the browser and Node.js, compiled to WebAssembly with Emscripten"
         LANGUAGES
             CXX
diff --git a/package.json b/package.json
index d6e586710..43572f977 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "wasm-vips",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "libvips for the browser and Node.js, compiled to WebAssembly with Emscripten",
   "homepage": "https://github.com/kleisauke/wasm-vips",
   "bugs": {
diff --git a/playground/package.json b/playground/package.json
index 3c5217395..3c703b300 100644
--- a/playground/package.json
+++ b/playground/package.json
@@ -1,6 +1,6 @@
 {
   "name": "wasm-vips-playground",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "private": true,
   "description": "A playground for experimenting with wasm-vips",
   "homepage": "https://github.com/kleisauke/wasm-vips/tree/master/playground#readme",
diff --git a/test/bench/package.json b/test/bench/package.json
index 985f38fe4..17299d596 100644
--- a/test/bench/package.json
+++ b/test/bench/package.json
@@ -1,6 +1,6 @@
 {
   "name": "wasm-vips-benchmark",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "private": true,
   "description": "Benchmark and performance tests for wasm-vips",
   "homepage": "https://github.com/kleisauke/wasm-vips/tree/master/test/bench#readme",
diff --git a/test/unit/package.json b/test/unit/package.json
index 718700e29..12351a7ac 100644
--- a/test/unit/package.json
+++ b/test/unit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "wasm-vips-test",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "private": true,
   "description": "Unit tests for wasm-vips",
   "homepage": "https://github.com/kleisauke/wasm-vips/tree/master/test/unit",