diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 0cba6dff2034cc2c062f267cfe3dd408d910fe31..577beb809e54108028906e557b5289256c3a80bc 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -18,6 +18,8 @@ before_script:
 stages:
   - test
   - build
+  - tag
+  - version_check
   - doc-update
   - version_check
 
@@ -57,6 +59,15 @@ version_check:
         - CODEVERS=$(cat utils/version.go | grep "const SEMVER =" | cut -d ' ' -f4 | tr -d '"')
         - if [[ $GITTAG != $CODEVERS ]]; then echo "VERSION NUMBER BAD $GITTAG != $CODEVER"; exit -1; fi
 
+tag:
+    stage: build
+    image: $DOCKER_IMAGE
+    script:
+        - git remote add origin_tags git@$GITLAB_SERVER:elixxir/xxdk-wasm.git || true
+        - GOOS=js GOARCH=wasm go build -ldflags '-w -s' -o release/xxdk.wasm main.go
+        - git tag $(sha256sum release/xxdk.wasm | awk '{ print $1 }') -f
+        - git push origin_tags -f --tags
+
 # This pipeline job will attempt to have pkg.go.dev update docs for xxdk-wasm.
 #
 # pkg.go.dev relies on the proxy.golang.org service (go module cache/proxy) to discover versions of