diff --git a/.github/workflows/auto-tag.yml b/.github/workflows/auto-tag.yml
new file mode 100644
index 000000000..7e72e898d
--- /dev/null
+++ b/.github/workflows/auto-tag.yml
@@ -0,0 +1,38 @@
+name: Create Tag
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+jobs:
+  create_tag:
+    runs-on: ubuntu-latest
+    if: startsWith(github.event.comment.body, '/create tag')
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Validate version number and get comment
+        id: validate
+        run: |
+          COMMENT="${{ github.event.comment.body }}"
+          VERSION=$(echo $COMMENT | cut -d ' ' -f 3)
+          TAG_COMMENT=$(echo $COMMENT | cut -d '"' -f 2)
+          if [[ $VERSION =~ ^v([0-9]+\.){2}[0-9]+$ ]]; then
+            echo "version=$VERSION" >> $GITHUB_STATE
+            echo "tag_comment=$TAG_COMMENT" >> $GITHUB_STATE
+          else
+            echo "Invalid version number."
+            exit 1
+          fi
+
+      - name: Create a new tag
+        env:
+          GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+        run: |
+          source $GITHUB_STATE
+          git tag -a $VERSION -m "$tag_comment"
+          git push origin $VERSION
+          echo "tag_created=$VERSION" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/milestone.yml b/.github/workflows/milestone.yml
new file mode 100644
index 000000000..db39943e6
--- /dev/null
+++ b/.github/workflows/milestone.yml
@@ -0,0 +1,58 @@
+# shamelessly copied from https://github.com/sigstore/cosign/blob/main/.github/workflows/milestone.yaml
+
+name: milestone
+
+on:
+  pull_request_target:
+    types: [closed]
+    branches:
+      - main
+
+jobs:
+  milestone:
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: none
+      checks: none
+      contents: read
+      deployments: none
+      issues: write
+      packages: none
+      pull-requests: write
+      repository-projects: none
+      security-events: none
+      statuses: none
+
+    steps:
+      - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
+        with:
+          script: |
+            if (!context.payload.pull_request.merged) {
+              console.log('PR was not merged, skipping.');
+              return;
+            }
+
+            if (!!context.payload.pull_request.milestone) {
+              console.log('PR has existing milestone, skipping.');
+              return;
+            }
+
+            milestones = await github.rest.issues.listMilestones({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              sort: 'due_on',
+              direction: 'asc'
+            })
+            if (milestones.data.length === 0) {
+              console.log('There are no milestones, skipping.');
+              return;
+            }
+
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              milestone: milestones.data[0].number
+            });