diff --git a/.github/workflows/prod.yml b/.github/workflows/prod.yml
new file mode 100644
index 00000000..7333d2ca
--- /dev/null
+++ b/.github/workflows/prod.yml
@@ -0,0 +1,46 @@
+name: Publish upgrade artifacts to production
+
+on:
+  push:
+    branches:
+      - release
+env:
+  INCLUDE_ERTS: false
+  MIX_ENV: prod
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      id-token: write    
+    steps:
+      - uses: actions/checkout@v2
+      - name: Setup elixir
+        id: beam
+        uses: erlef/setup-beam@v1
+        with:
+          otp-version: 25.3.2 # Define the OTP version [required]
+          elixir-version: 1.14.5 # Define the elixir version [required]
+          version-type: strict
+      - name: Cache Mix
+        uses: actions/cache@v1
+        with:
+          path: deps
+          key: ${{ runner.os }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}
+          restore-keys: |
+            ${{ runner.os }}-mix-
+      - name: Install dependencies
+        run: mix deps.get
+      - name: Make release
+        run: mix release supavisor
+      - name: Create tarball
+        run: cd _build/prod/rel/ && tar -czvf ${{ secrets.TARBALL_REGIONS_PROD }}_supavisor_v$(cat ../../../VERSION)_$(date "+%s").tar.gz supavisor
+      - name: configure aws credentials - production
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
+          aws-region: "us-east-1"
+      - name: Deploy to S3
+        shell: bash
+        run: aws s3 sync ./_build/prod/rel/ ${{ secrets.TARBALLS_PATH_PROD }} --exclude '*' --include '*tar.gz'
diff --git a/VERSION b/VERSION
index a602fc9e..b0bb8785 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.9.4
+0.9.5