diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..bcd7629
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,72 @@
+---
+name: Publish
+
+on:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          # hatch-vcs derives the version from the git tag, so the full
+          # history and tags must be available (default checkout is shallow).
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        with:
+          python-version: "3.x"
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+      - name: Upload distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: dist
+          path: dist/
+
+  # Every push to main and every tag publishes to TestPyPI.
+  testpypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/morgan/
+    permissions:
+      id-token: write  # required for PyPI trusted publishing (OIDC)
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true  # tolerate re-runs of an already-uploaded version
+
+  # Tags additionally publish to PyPI, gated on TestPyPI succeeding.
+  pypi:
+    needs: [build, testpypi]
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/morgan/
+    permissions:
+      id-token: write  # required for PyPI trusted publishing (OIDC)
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
diff --git a/morgan/__about__.py b/morgan/__about__.py
deleted file mode 100644
index 224f1fb..0000000
--- a/morgan/__about__.py
+++ /dev/null
@@ -1 +0,0 @@
-__version__ = "0.14.4"
diff --git a/morgan/__init__.py b/morgan/__init__.py
index b1a5144..d5c993b 100644
--- a/morgan/__init__.py
+++ b/morgan/__init__.py
@@ -7,6 +7,7 @@
 import os
 import os.path
 import re
+import sys
 import tarfile
 import traceback
 import urllib.error
@@ -23,7 +24,6 @@
 import packaging.version
 
 from morgan import configurator, metadata, server
-from morgan.__about__ import __version__
 from morgan.registry import GitLabRegistry, LocalRegistry, Registry
 from morgan.utils import (
     Cache,
@@ -33,6 +33,17 @@
     touch_file,
 )
 
+if sys.version_info < (3, 8):
+    import importlib_metadata as _metadata
+else:
+    from importlib import metadata as _metadata
+
+try:
+    __version__ = _metadata.version("morgan")
+except _metadata.PackageNotFoundError:
+    # Running from a source tree that hasn't been installed.
+    __version__ = "0.0.0+unknown"
+
 PYPI_ADDRESS = "https://pypi.org/simple/"
 PREFERRED_HASH_ALG = "sha256"
 
diff --git a/pyproject.toml b/pyproject.toml
index 65f0e4b..bda425b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["hatchling>=1.10.0"]
+requires = ["hatchling>=1.10.0", "hatch-vcs"]
 build-backend = "hatchling.build"
 
 [project]
@@ -49,7 +49,12 @@ lint = [
 ]
 
 [tool.hatch.version]
-path = "morgan/__about__.py"
+# Version is derived from the latest git tag, e.g. "v0.15.0" -> "0.15.0".
+source = "vcs"
+
+[tool.hatch.version.raw-options]
+# Drop the local "+<hash>" segment; (Test)PyPI rejects local version labels.
+local_scheme = "no-local-version"
 
 [project.urls]
 "Homepage" = "https://github.com/ido50/morgan"