diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index efdb183..bedae1a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        ruby: ['3.2', '3.3', '3.4']
+        ruby: ['3.3', '3.4', '4.0']
     
     steps:
     - uses: actions/checkout@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..191f4a9
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,134 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags: ["v*"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  source-gem:
+    name: Build source gem
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - run: bundle exec rake build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: source-gem
+          path: pkg/*.gem
+          if-no-files-found: error
+
+  cross-compile:
+    name: Build native gem (${{ matrix.platform }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - x86_64-linux
+          - aarch64-linux
+          - arm64-darwin
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - run: bundle exec rb-sys-dock --ruby-versions 4.0,3.4,3.3 --platform ${{ matrix.platform }} --build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: cross-gem-${{ matrix.platform }}
+          path: pkg/*.gem
+          if-no-files-found: error
+
+  smoke-test:
+    name: Smoke test (Ruby ${{ matrix.ruby }})
+    needs: [cross-compile]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.3", "3.4"]
+    steps:
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: cross-gem-x86_64-linux
+          path: pkg/
+
+      - name: Install native gem
+        run: gem install pkg/wreq-*-x86_64-linux.gem
+
+      - name: Verify gem loads and prints version
+        run: ruby -rwreq -e "puts Wreq::VERSION"
+
+  release:
+    name: Release
+    needs: [source-gem, cross-compile, smoke-test]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: pkg/
+          pattern: "{cross-gem-*,source-gem}"
+          merge-multiple: true
+
+      - name: List gems
+        run: ls -la pkg/*.gem
+
+      - name: Verify version matches tag
+        run: |
+          GEM_VERSION=$(bundle exec rake version)
+          if [ "v${GEM_VERSION}" != "${{ github.ref_name }}" ]; then
+            echo "::error::Gem version v${GEM_VERSION} does not match tag ${{ github.ref_name }}"
+            exit 1
+          fi
+
+      - name: Configure trusted publishing credentials
+        uses: rubygems/configure-rubygems-credentials@v1
+
+      - name: Push all gems to RubyGems.org
+        run: |
+          failed=0
+          for gem in pkg/*.gem; do
+            echo "Pushing $(basename $gem)..."
+            if ! gem push "$gem"; then
+              echo "::warning::Failed to push $(basename $gem)"
+              failed=1
+            fi
+          done
+          if [ "$failed" -eq 1 ]; then
+            echo "::error::Some gems failed to push"
+            exit 1
+          fi
diff --git a/Gemfile b/Gemfile
index 2eb09ea..3e487a6 100644
--- a/Gemfile
+++ b/Gemfile
@@ -7,8 +7,7 @@ group :development, :test do
   gem "rake", ">= 13.2"
   gem "rb_sys", "~> 0.9.110" # for Makefile generation in extconf.rb
   gem "rake-compiler", "~> 1.2.9" # to build a debug build
-  gem "minitest", "~> 5.25.0" # test library
-  gem "minitest-reporters", "~> 1.7.1" # better test output
+  gem "minitest", "~> 6.0" # test library
   gem "activesupport", "~> 8.0.1" # testing support
   gem "standard", "~> 1.52" # linter with pre-specified rules
   gem "redcarpet", "~> 3.6" # for documentation markdown parsing
diff --git a/Rakefile b/Rakefile
index 1fdd0ae..8477cb2 100644
--- a/Rakefile
+++ b/Rakefile
@@ -26,7 +26,7 @@ RbSys::ExtensionTask.new(CRATE_PACKAGE_NAME, GEMSPEC) do |ext|
 
   # Override Ruby version for native gems (keep in sync with wreq.gemspec)
   ext.cross_compiling do |spec|
-    spec.required_ruby_version = ">= 3.2", "< 3.5.dev"
+    spec.required_ruby_version = ">= 3.3", "< 4.1.dev"
   end
 end
 
diff --git a/wreq.gemspec b/wreq.gemspec
index c3c351e..378a4ef 100644
--- a/wreq.gemspec
+++ b/wreq.gemspec
@@ -59,7 +59,7 @@ Gem::Specification.new do |spec|
   # - not end of life
   #
   # keep in sync with `Rakefile`.
-  spec.required_ruby_version = ">= 3.2"
+  spec.required_ruby_version = ">= 3.3"
 
   # intentionally skipping rb_sys gem because newer Rubygems will be present
 end