diff --git a/README.md b/README.md
index a586af8..6cb2e87 100644
--- a/README.md
+++ b/README.md
@@ -148,6 +148,19 @@ This topic is [covered in jacdac-c](https://github.com/microsoft/jacdac-c#adding
 When adding services or drivers, you can put them in `addons/` folder of your modules repo,
 or submit them as PRs in `jacdac-c`.
 
+## Release process
+
+Use `make bump` to create a new release.
+This will ask you for a version number (providing a default that just updates the patch number),
+update `CHANGES.md`, create a git tag, and push it to the origin.
+
+If the `jacdac-acme-corp-modules` repo is public on github, the github action will create a new binary
+file and place it under `dist/fw-VERSION.uf2`, so there's nothing else to do.
+
+If you want to build by hand, run `make drop` after `make bump` and copy `built/fw-VERSION.uf2`
+to `dist/fw-VERSION.uf2` in your release repo.
+You should probably also copy over `CHANGES.md`, so your users have some idea of what it being updated.
+
 ## Contributing
 
 This project welcomes contributions and suggestions.  Most contributions require you to agree to a
diff --git a/build.mk b/build.mk
index d7e5560..887a650 100644
--- a/build.mk
+++ b/build.mk
@@ -233,10 +233,27 @@ $(BUILT)/jd/prof-%.o: targets/$(TARGET)/profile/%.c
 
 FW_VERSION = $(shell git describe --dirty --tags --match 'v[0-9]*' --always | sed -e 's/-dirty/-'"`date +%Y%m%d-%H%M`/")
 
+bump:
+	sh $(SCRIPTS)/bump.sh
+
 refresh-version:
 	@mkdir -p $(BUILT_BIN)
 	echo 'const char app_fw_version[] = "$(FW_VERSION)";' > $(BUILT_BIN)/version.c
 
+check-release:
+	if [ "X`git describe --exact --tags --match 'v[0-9]*' 2>/dev/null`" != "X" ]; then $(MAKE) build-release ; fi
+
+build-release: drop
+	# avoid re-computing FW_VERSION many times
+	$(MAKE) do-build-release FW_VERSION=$(FW_VERSION)
+
+do-build-release:
+	cp built/drop.uf2 dist/fw-$(FW_VERSION).uf2
+	git add dist/fw-$(FW_VERSION).uf2
+	if [ "X$$GITHUB_WORKFLOW" != "X" ] ; then git config user.email "<>" && git config user.name "GitHub Bot" ; fi
+	git commit -m "[skip ci] firmware $(FW_VERSION) built"
+	git push
+
 $(BUILT_BIN)/%.o: $(BUILT_BIN)/%.c
 	$(V)$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ -c $<
 
@@ -281,6 +298,7 @@ drop: $(addprefix targ-,$(DROP_TARGETS))
 	cd built; cat $(addsuffix /app-*.uf2,$(DROP_TARGETS)) > drop.uf2
 	cd built; cat $(addsuffix /blup-*.uf2,$(DROP_TARGETS)) > bootloader-update.uf2
 	@ls -l built/drop.uf2 built/bootloader-update.uf2
+	cp built/drop.uf2 built/fw-$(FW_VERSION).uf2
 
 ff: full-flash
 
diff --git a/scripts/bump.sh b/scripts/bump.sh
new file mode 100755
index 0000000..c762bf1
--- /dev/null
+++ b/scripts/bump.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+if [ "X`git status --porcelain --untracked-files=no`" != X ] ; then
+  git status
+  echo
+  echo "*** You have local changes; cannot bump." 
+  exit 1
+fi
+
+git pull || exit 1
+
+eval `git describe --dirty --tags --match 'v[0-9]*' --always | sed -e 's/-.*//; s/v/v0=/; s/\./ v1=/; s/\./ v2=/'`
+defl=0.0.0
+if [ "X$v0" != X ] ; then
+  defl=$v0.$v1.$(($v2 + 1))
+fi
+set -e
+echo "Enter version [Enter = $defl; Ctrl-C to cancel]:"
+read ver
+if [ "X$ver" = "X" ] ; then
+  ver="$defl"
+fi
+
+node jacdac-stm32x0/scripts/git-sublog.js -u "$ver" CHANGES.md
+
+set -x
+get add CHANGES.md
+git commit -m "Automatic changelog for $ver"
+git tag "$ver"
+git push --tags
+git push
diff --git a/scripts/git-sublog.js b/scripts/git-sublog.js
index bff9b41..e2e04ab 100644
--- a/scripts/git-sublog.js
+++ b/scripts/git-sublog.js
@@ -2,11 +2,11 @@ const fs = require("fs")
 const path = require("path")
 const child_process = require("child_process")
 
-let markdown = 0
-
 async function logfor(dir, myurl, range) {
     if (!range) range = ""
 
+    // console.log(`log ${dir} / ${myurl} / ${range}`)
+
     const submoduleStart = {}
     const submoduleEnd = {}
 
@@ -26,7 +26,7 @@ async function logfor(dir, myurl, range) {
         myurl = m[1]
     }
 
-    let res = `## Changelog for ${myurl.replace(/.*github.com\//, "")}\n\n`
+    let res = `### ${myurl.replace(/.*github.com\//, "")}\n\n`
 
     await new Promise((resolve, reject) => child_process.exec(`git log --submodule=log --oneline --patch --decorate=full ${range}`, {
         maxBuffer: 100 * 1024 * 1024,
@@ -55,14 +55,10 @@ async function logfor(dir, myurl, range) {
                     break
 
                 // note that /pull/123 will redirect to /issue/123 if it's an issue
-                if (markdown)
-                    msg = msg.replace(/#(\d+)/g, (f, n) => `[${f}](${myurl}/pull/${n})`)
+                msg = msg.replace(/#(\d+)/g, (f, n) => `[${f}](${myurl}/pull/${n})`)
 
                 numcommits++
-                if (markdown)
-                    res += `* [${commit}](${myurl}/commit/${commit}) ${msg}\n`
-                else
-                    res += `${commit} ${msg}\n`
+                res += `* [${commit}](${myurl}/commit/${commit}) ${msg}\n`
             }
             m = /^Submodule (\S+) ([0-9a-f]+)\.\.([0-9a-f]+)/.exec(line)
             if (m) {
@@ -86,13 +82,29 @@ async function logfor(dir, myurl, range) {
     return res
 }
 
-async function main() {
+async function main(args) {
+    let header = ""
+    let chgpath = ""
+
+    if (args[0] == "-u") {
+        args.shift()
+        const v = args.shift()
+        header = `## Version ${v}\n\n`
+        chgpath = args.shift()
+    }
+
     try {
-        const res = await logfor(".")
-        console.log(res.trim())
+        const res = await logfor(".", null, args[0])
+        const md = header + res + "\n"
+        const plain = md.replace(/\[([^\]\n]+)\]\([^\(\)\n]+\)/g, (_, x) => x)
+        if (chgpath) {
+            const chg = fs.readFileSync(chgpath, "utf8")
+            fs.writeFileSync(chgpath, md + chg)
+        }
+        console.log(plain.trim())
     } catch (e) {
         console.error(e)
     }
 }
 
-main()
\ No newline at end of file
+main(process.argv.slice(2))