diff --git a/.github/workflows/configure.yml b/.github/workflows/configure.yml
index 3dd248e..23f6022 100644
--- a/.github/workflows/configure.yml
+++ b/.github/workflows/configure.yml
@@ -82,57 +82,3 @@
       working-directory: build dir
       if: github.event_name == 'workflow_dispatch'
       run: cmake --build . --config Release --target check
-
-  # This builds the sdists and wheels and makes sure the files are exactly as
-  # expected. Using Windows and Python 2.7, since that is often the most
-  # challenging matrix element.
-  test-packaging:
-    name: 🐍 2.7 • 📦 tests • windows-latest
-    runs-on: windows-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Setup 🐍 2.7
-      uses: actions/setup-python@v2
-      with:
-        python-version: 2.7
-
-    - name: Prepare env
-      run: python -m pip install -r tests/requirements.txt --prefer-binary
-
-    - name: Python Packaging tests
-      run: pytest tests/extra_python_package/
-
-
-  # This runs the packaging tests and also builds and saves the packages as
-  # artifacts.
-  packaging:
-    name: 🐍 3.8 • 📦 & 📦 tests • ubuntu-latest
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Setup 🐍 3.8
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.8
-
-    - name: Prepare env
-      run: python -m pip install -r tests/requirements.txt build twine --prefer-binary
-
-    - name: Python Packaging tests
-      run: pytest tests/extra_python_package/
-
-    - name: Build SDist and wheels
-      run: |
-        python -m build -s -w .
-        PYBIND11_GLOBAL_SDIST=1 python -m build -s -w .
-
-    - name: Check metadata
-      run: twine check dist/*
-
-    - uses: actions/upload-artifact@v2
-      with:
-        path: dist/*
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
new file mode 100644
index 0000000..bfd807b
--- /dev/null
+++ b/.github/workflows/pip.yml
@@ -0,0 +1,89 @@
+name: Pip
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+    - master
+    - stable
+    - v*
+  release:
+    types:
+    - published
+
+jobs:
+  # This builds the sdists and wheels and makes sure the files are exactly as
+  # expected. Using Windows and Python 2.7, since that is often the most
+  # challenging matrix element.
+  test-packaging:
+    name: 🐍 2.7 • 📦 tests • windows-latest
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Setup 🐍 2.7
+      uses: actions/setup-python@v2
+      with:
+        python-version: 2.7
+
+    - name: Prepare env
+      run: python -m pip install -r tests/requirements.txt --prefer-binary
+
+    - name: Python Packaging tests
+      run: pytest tests/extra_python_package/
+
+
+  # This runs the packaging tests and also builds and saves the packages as
+  # artifacts.
+  packaging:
+    name: 🐍 3.8 • 📦 & 📦 tests • ubuntu-latest
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Setup 🐍 3.8
+      uses: actions/setup-python@v2
+      with:
+        python-version: 3.8
+
+    - name: Prepare env
+      run: python -m pip install -r tests/requirements.txt build twine --prefer-binary
+
+    - name: Python Packaging tests
+      run: pytest tests/extra_python_package/
+
+    - name: Build SDist and wheels
+      run: |
+        python -m build
+        PYBIND11_GLOBAL_SDIST=1 python -m build
+
+    - name: Check metadata
+      run: twine check dist/*
+
+    - uses: actions/upload-artifact@v2
+      with:
+        path: dist/*
+
+
+  # When a GitHub release is made, upload the artifacts to PyPI
+  upload:
+    name: Upload to PyPI
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release' && github.event.action == 'published'
+    needs: [packaging]
+
+    steps:
+    - uses: actions/setup-python@v2
+
+    - uses: actions/download_artifacts@v2
+      with:
+        path: dist
+        name: artifact
+
+    - uses: pypa/gh-action-pypi-publish@v1.3.1
+      with:
+        user: __token__
+        password: ${{ secrets.pypi_password }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 71513c9..fae8f38 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -53,7 +53,7 @@
 
 # CMake formatting
 - repo: https://github.com/cheshirekow/cmake-format-precommit
-  rev: v0.6.11
+  rev: v0.6.13
   hooks:
   - id: cmake-format
     additional_dependencies: [pyyaml]
@@ -62,7 +62,7 @@
 
 # Checks the manifest for missing files (native support)
 - repo: https://github.com/mgedmin/check-manifest
-  rev: "0.42"
+  rev: "0.43"
   hooks:
   - id: check-manifest
     # This is a slow hook, so only run this if --hook-stage manual is passed
diff --git a/docs/release.rst b/docs/release.rst
index 9846f97..9c3d945 100644
--- a/docs/release.rst
+++ b/docs/release.rst
@@ -1,21 +1,75 @@
-To release a new version of pybind11:
+On version numbers
+^^^^^^^^^^^^^^^^^^
 
-- Update the version number and push to pypi
-    - Update ``pybind11/_version.py`` (set release version, remove 'dev').
-    - Update ``PYBIND11_VERSION_MAJOR`` etc. in ``include/pybind11/detail/common.h``.
-    - Ensure that all the information in ``setup.py`` is up-to-date.
-    - Update version in ``docs/conf.py``.
-    - Tag release date in ``docs/changelog.rst``.
-    - ``git add`` and ``git commit``.
-    - if new minor version: ``git checkout -b vX.Y``, ``git push -u origin vX.Y``
-    - ``git tag -a vX.Y.Z -m 'vX.Y.Z release'``.
+The two version numbers (C++ and Python) must match when combined (checked when
+you build the PyPI package), and must be a valid `PEP 440
+<https://www.python.org/dev/peps/pep-0440>`_ version when combined.
+
+For example:
+
+.. code-block:: C++
+
+    #define PYBIND11_VERSION_MAJOR X
+    #define PYBIND11_VERSION_MINOR Y
+    #define PYBIND11_VERSION_PATCH Z.dev1
+
+For beta, ``PYBIND11_VERSION_PATCH`` should be ``Z.b1``. RC's can be ``Z.rc1``.
+Always include the dot (even though PEP 440 allows it to be dropped). For a
+final release, this must be a simple integer.
+
+
+To release a new version of pybind11:
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- Update the version number
+  - Update ``PYBIND11_VERSION_MAJOR`` etc. in
+    ``include/pybind11/detail/common.h``. PATCH should be a simple integer.
+  - Update ``pybind11/_version.py`` (match above)
+  - Ensure that all the information in ``setup.py`` is up-to-date.
+  - Add release date in ``docs/changelog.rst``.
+  - ``git add`` and ``git commit``, ``git push``. **Ensure CI passes**. (If it
+    fails due to a known flake issue, either ignore or restart CI.)
+- Add a release branch if this is a new minor version
+  - ``git checkout -b vX.Y``, ``git push -u origin vX.Y``
+- Update tags
+  - ``git tag -a vX.Y.Z -m 'vX.Y.Z release'``.
+  - ``git push --tags``.
+- Update stable
+    - ``git checkout stable``
+    - ``git merge master``
     - ``git push``
-    - ``git push --tags``.
-    - ``python setup.py sdist upload``.
-    - ``python setup.py bdist_wheel upload``.
+- Make a GitHub release (this shows up in the UI, sends new release
+  notifications to users watching releases, and also uploads PyPI packages).
+  (Note: if you do not use an existing tag, this creates a new lightweight tag
+  for you, so you could skip the above step).
+  - GUI method: click "Create a new release" on the far right, fill in the tag
+    name, fill in a release name like "Version X.Y.Z", and optionally
+    copy-and-paste the changelog into the description (processed as markdown by
+    Pandoc). Check "pre-release" if this is a beta/RC.
+  - CLI method: with ``gh`` installed, run ``gh release create vX.Y.Z -t "Version X.Y.Z"``
+    If this is a pre-release, add ``-p``.
+
 - Get back to work
-    - Update ``_version.py`` (add 'dev' and increment minor).
-    - Update version in ``docs/conf.py``
-    - Update version macros in ``include/pybind11/common.h``
-    - ``git add`` and ``git commit``.
-      ``git push``
+  - Make sure you are on master, not somewhere else: ``git checkout master``
+  - Update version macros in ``include/pybind11/common.h`` (set PATCH to
+    ``0.dev1`` and increment MINOR).
+  - Update ``_version.py`` to match
+  - Add a plot for in-development updates in ``docs/changelog.rst``.
+  - ``git add``, ``git commit``, ``git push``
+
+If a version branch is updated, remember to set PATCH to ``1.dev1``.
+
+
+Manual packaging
+^^^^^^^^^^^^^^^^
+
+If you need to manually upload releases, you can download the releases from the job artifacts and upload them with twine. You can also make the files locally (not recommended in general, as your local directory is more likely to be "dirty" and SDists love picking up random unrelated/hidden files); this is the procedure:
+
+.. code-block:: bash
+
+    python3 -m pip install build
+    python3 -m build
+    PYBIND11_SDIST_GLOBAL=1 python3 -m build
+    twine upload dist/*
+
+This makes SDists and wheels, and the final line uploads them.
diff --git a/pyproject.toml b/pyproject.toml
index 3bab1c1..5c9d153 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,3 +1,3 @@
 [build-system]
-requires = ["setuptools", "wheel", "cmake==3.18.0", "ninja"]
+requires = ["setuptools>=42", "wheel", "cmake>=3.18", "ninja"]
 build-backend = "setuptools.build_meta"
diff --git a/tools/pyproject.toml b/tools/pyproject.toml
index 9787c3b..8fe2f47 100644
--- a/tools/pyproject.toml
+++ b/tools/pyproject.toml
@@ -1,3 +1,3 @@
 [build-system]
-requires = ["setuptools", "wheel"]
+requires = ["setuptools>=42", "wheel"]
 build-backend = "setuptools.build_meta"