diff --git a/.github/workflows/yank.yml b/.github/workflows/yank.yml
new file mode 100644
index 0000000..8a85736
--- /dev/null
+++ b/.github/workflows/yank.yml
@@ -0,0 +1,36 @@
+name: Yank a public release
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to retract from the public repo (e.g. v0.10.0 or v0.10.0-beta1)'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  yank:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Validate the tag format
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          case "$TAG" in
+            v[0-9]*.[0-9]*.[0-9]*|v[0-9]*.[0-9]*.[0-9]*-beta[0-9]*) ;;
+            *) echo "refusing to yank an unrecognised tag: $TAG" >&2; exit 1 ;;
+          esac
+      - name: Checkout public repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ vars.PUBLIC_REPO_SLUG }}
+          token: ${{ secrets.PUBLIC_REPO_TOKEN }}
+          fetch-depth: 0
+          path: pub
+      - name: Delete the tag on the public repo
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          git -C pub push origin --delete "refs/tags/${TAG}"