diff --git a/.github/workflows/promote-public.yml b/.github/workflows/promote-public.yml
new file mode 100644
index 0000000..9517322
--- /dev/null
+++ b/.github/workflows/promote-public.yml
@@ -0,0 +1,39 @@
+name: Promote to public (beta channel)
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish (e.g. v0.10.0-beta1)'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Checkout private repo at the tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+          fetch-depth: 0
+          path: src
+      - name: Checkout public repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ vars.PUBLIC_REPO_SLUG }}
+          token: ${{ secrets.PUBLIC_REPO_TOKEN }}
+          fetch-depth: 0
+          path: pub
+      - name: Promote (clean release commit + tag)
+        run: |
+          git config --global user.name 'clusev-release'
+          git config --global user.email 'release@clusev'
+          chmod +x src/scripts/promote.sh
+          src/scripts/promote.sh "$PWD/src" "${{ inputs.tag }}" "$PWD/pub" "Release ${{ inputs.tag }}"
+      - name: Push to public
+        run: |
+          git -C pub push origin HEAD:main
+          git -C pub push origin "refs/tags/${{ inputs.tag }}"
diff --git a/.github/workflows/promote-stable.yml b/.github/workflows/promote-stable.yml
new file mode 100644
index 0000000..8bfbd14
--- /dev/null
+++ b/.github/workflows/promote-stable.yml
@@ -0,0 +1,45 @@
+name: Promote beta to stable
+on:
+  workflow_dispatch:
+    inputs:
+      betaTag:
+        description: 'Beta tag to finalise (e.g. v0.10.0-beta3)'
+        required: true
+      stableTag:
+        description: 'Stable tag to publish (e.g. v0.10.0)'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Checkout private repo at the beta tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.betaTag }}
+          fetch-depth: 0
+          path: src
+      - name: Tag the same commit as stable (in the private repo, for traceability)
+        run: |
+          git -C src tag "${{ inputs.stableTag }}" "${{ inputs.betaTag }}^{commit}"
+      - name: Checkout public repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ vars.PUBLIC_REPO_SLUG }}
+          token: ${{ secrets.PUBLIC_REPO_TOKEN }}
+          fetch-depth: 0
+          path: pub
+      - name: Promote stable (clean release commit + tag)
+        run: |
+          git config --global user.name 'clusev-release'
+          git config --global user.email 'release@clusev'
+          chmod +x src/scripts/promote.sh
+          src/scripts/promote.sh "$PWD/src" "${{ inputs.stableTag }}" "$PWD/pub" "Release ${{ inputs.stableTag }}"
+      - name: Push to public
+        run: |
+          git -C pub push origin HEAD:main
+          git -C pub push origin "refs/tags/${{ inputs.stableTag }}"