diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
deleted file mode 100644
index a162d3c400..0000000000
--- a/.github/workflows/bump-version.yml
+++ /dev/null
@@ -1,101 +0,0 @@
-# The purpose of this workflow is to, once a month, trigger Wasmtime's release
-# process. All that actually happens here is that whenever this is triggered it
-# will send a PR to the main repository with the version numbers automatically
-# bumped. The next stage of the process is to simply merge the PR, and the
-# `push-tag.yml` process takes over from there.
-#
-# Note that this creates a commit and a PR with a personal access token to
-# ensure that the PR gets CI triggered on it. Additionally the commit message
-# is specifically worded to get recognized by `push-tag.yml`.
-
-name: "Bump version number"
-on:
-  schedule:
-    # “At 00:00 on day-of-month 5.”
-    #
-    # https://crontab.guru/#0_0_5_*_*
-    - cron: '0 0 5 * *'
-
-  # Allow manually triggering this request via the button at
-  # https://github.com/bytecodealliance/wasmtime/actions/workflows/bump-version.yml
-  workflow_dispatch:
-    inputs:
-      publish_cmd:
-        description: 'Publish script argument: "bump" or "bump-patch"'
-        required: false
-        default: 'bump'
-
-jobs:
-  bump_version:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: true
-      - run: rustup update stable && rustup default stable
-      - name: Bump versions locally
-        id: bump
-        run: |
-          rustc scripts/publish.rs
-          if [ "${{ github.event.inputs.publish_cmd }}" != "" ]; then
-            # this was manually triggered
-            ./publish ${{ github.event.inputs.publish_cmd }}
-          else
-            # this was cron-triggered.
-            ./publish bump
-          fi
-          version=$(grep '^version =' Cargo.toml | head -n 1 | sed 's/.*"\(.*\)"/\1/')
-          echo "::set-output name=version::$version"
-
-      - name: Commit version changes
-        run: |
-          git config user.name 'Wasmtime Publish'
-          git config user.email 'wasmtime-publish@users.noreply.github.com'
-          git commit -a -F-<<EOF
-          Bump Wasmtime to ${{ steps.bump.outputs.version }}
-
-          [automatically-tag-and-release-this-commit]
-          EOF
-
-      - name: Push to remote
-        run: |
-          git remote set-url origin https://git:${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/${{ github.repository }}
-          git push origin HEAD:ci/bump-to-${{ steps.bump.outputs.version }} -f
-
-      - name: Make a PR
-        # Note that the syntax here is kinda funky, and the general gist is that
-        # I couldn't figure out a good way to have a multiline string-literal
-        # become a json-encoded string literal to send to GitHub. This
-        # represents my best attempt.
-        run: |
-          cat > pr-body <<-EOF
-          This is an automated pull request from CI which is intended to
-          notify maintainers that it's time to release Wasmtime version
-          ${{ steps.bump.outputs.version }}. Version numbers have been bumped
-          in this PR automatically and the release process will automatically
-          enter the next stages once this PR is merged.
-
-          It's recommended that maintainers double-check that [RELEASES.md]
-          is up-to-date. If not please feel free to push to this PR any
-          modifications to the release notes. Additionally before merging it's
-          probably best to double-check the [release process] and make sure that
-          everything is ship-shape.
-
-          [RELEASES.md]: https://github.com/bytecodealliance/wasmtime/blob/main/RELEASES.md
-          [release process]: https://docs.wasmtime.dev/contributing-release-process.html
-          EOF
-          body=$(jq -sR < ./pr-body)
-
-          curl --include --request POST \
-            https://api.github.com/repos/${{ github.repository }}/pulls \
-            --header "Authorization: token ${{ secrets.PERSONAL_ACCESS_TOKEN }}" \
-            --data @- << EOF
-          {
-            "head": "ci/bump-to-${{ steps.bump.outputs.version }}",
-            "base": "${{ github.ref_name }}",
-            "title": "Release Wasmtime ${{ steps.bump.outputs.version }}",
-            "body": $body,
-            "maintainer_can_modify": true
-
-          }
-          EOF
diff --git a/.github/workflows/release-process.yml b/.github/workflows/release-process.yml
new file mode 100644
index 0000000000..d35b6d8402
--- /dev/null
+++ b/.github/workflows/release-process.yml
@@ -0,0 +1,231 @@
+# The purpose of this workflow is to, once a month, trigger Wasmtime's release
+# process. All that actually happens here is that whenever this is triggered it
+# will send a PR to the main repository with the version numbers automatically
+# bumped. The next stage of the process is to simply merge the PR, and the
+# `push-tag.yml` process takes over from there.
+#
+# Note that this creates a commit and a PR with a personal access token to
+# ensure that the PR gets CI triggered on it. Additionally the commit message
+# is specifically worded to get recognized by `push-tag.yml`.
+
+name: "Automated Release Process"
+on:
+  schedule:
+    # “At 00:00 on day-of-month 5.”
+    #
+    # https://crontab.guru/#0_0_5_*_*
+    - cron: '0 0 5 * *'
+    - cron: '0 0 20 * *'
+
+  # Allow manually triggering this request via the button at
+  # https://github.com/bytecodealliance/wasmtime/actions/workflows/bump-version.yml
+  # TODO
+  workflow_dispatch:
+    inputs:
+      action:
+        description: 'Publish script argument: "cut", "release-latest", or "release-patch"'
+        required: false
+        default: 'cut'
+
+jobs:
+  release_process:
+    name: Run the release process
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: true
+      - name: Setup
+        run: |
+          rustc scripts/publish.rs
+          git config user.name 'Wasmtime Publish'
+          git config user.email 'wasmtime-publish@users.noreply.github.com'
+          git remote set-url origin https://git:${{ secrets.PERSONAL_ACCESS_TOKEN }}@github.com/${{ github.repository }}
+
+      - name: Bump major version number
+        run: |
+          # Push the current contents of `main` to a new release branch
+          cur=$(./ci/print-current-version.sh)
+          git push origin HEAD:release-$cur
+
+          # Update version numbers and make a commit indicating that. Note that
+          # on merge this will not trigger a publish.
+          ./publish bump
+          num=$(./ci/print-current-version.sh)
+
+          # Add a new section to the release notes for the new version.
+          cp RELEASES.md backup-releases
+          sed "s/VERSION/$num/" ci/RELEASES-template.md > RELEASES.md
+          cat backup-releases >> RELEASES.md
+          rm backup-releases
+
+          # Commit all of the above changes.
+          git commit -am "Bump Wasmtime to $num"
+
+          # Push the result to a branch and setup metadata for the step below
+          # that creates a PR
+          git push origin HEAD:ci/bump-to-$num
+          echo "PR_HEAD=ci/bump-to-$num" >> $GITHUB_ENV
+          echo "PR_TITLE=Bump Wasmtime to $num" >> $GITHUB_ENV
+          echo "PR_BASE=main" >> $GITHUB_ENV
+          cat > pr-body <<-EOF
+          This is an [automated pull request][process] from CI which indicates
+          that the next [\`release-$cur\` branch][branch] has been created and
+          the \`main\` branch is getting its version number bumped from $cur to
+          $num.
+
+          Maintainers should take a moment to review the [release
+          notes][RELEASES.md] for $cur, and if any changes are necessary send
+          PRs to the \`main\` branch to update [RELEASES.md] and then backport
+          these PRs to the [release branch][branch].
+
+          Another automated PR will be made in roughly 2 weeks time when for
+          the actual release itself.
+
+          If any issues arise on the \`main\` branch before the release is made
+          then the issue should first be fixed on \`main\` and then backported
+          to the \`release-$cur\` branch.
+
+          [RELEASES.md]: https://github.com/${{ github.repository }}/blob/main/RELEASES.md
+          [branch]: https://github.com/${{ github.repository }}/tree/release-$cur
+          [process]: https://docs.wasmtime.dev/contributing-release-process.html
+          EOF
+        if: >-
+          github.event.schedule == '0 0 5 * *' ||
+          github.event.inputs.action == 'cut'
+
+      - name: Perform latest release
+        run: |
+          git fetch origin
+          cur=$(git for-each-ref --sort=-committerdate refs/remotes/origin --format '%(refname)' | grep release | head -n 1 | sed 's/.*release-//')
+
+          # Update the release date for $cur on the `main` branch. Note that the
+          # sed here is a little complicated because we will have two entries in
+          # `RELEASES.md`, one for $cur+1 which `main` is at plus one for $cur
+          # which we're about to release. We only want to update the release
+          # date of the second one.
+          sed -i "/^##.*$cur/,+3 s/^Unreleased/Released $(date +'%Y-%m-%d')/" RELEASES.md
+          git commit -a -F-<<EOF
+          Update release date of Wasmtime $cur
+
+          [skip ci]
+          EOF
+          git push origin HEAD:ci/release-date-for-$cur
+
+          # In addition to the PR we'll make below to perform the actual release
+          # make a second PR to the `main` branch to note the release date in
+          # the release notes.
+          cat > pr-body <<-EOF
+          This is an [automated pull request][process] from CI which is updating
+          the release date of Wasmtime $cur to today. This PR's base branch
+          is \`main\` and a second PR will be coming to perform the actual
+          release which will be targeted at \`release-$cur\`.
+
+          [process]: https://docs.wasmtime.dev/contributing-release-process.html
+          EOF
+          body=$(jq -sR < ./pr-body)
+          curl --include --request POST \
+            https://api.github.com/repos/${{ github.repository }}/pulls \
+            --header "Authorization: token ${{ secrets.PERSONAL_ACCESS_TOKEN }}" \
+            --data @- << EOF
+          {
+            "head": "ci/release-date-for-$cur",
+            "base": "main",
+            "title": "Update release date of Wasmtime $cur",
+            "body": $body,
+            "maintainer_can_modify": true
+          }
+          EOF
+
+          # Move to the most recent release branch, update the release date and
+          # commit it, indicating that the commit is what will get tagged and
+          # released
+          git reset --hard origin/release-$cur
+          sed -i "s/^Unreleased/Released $(date +'%Y-%m-%d')/" RELEASES.md
+          git commit -a -F-<<EOF
+          Release Wasmtime $cur
+
+          [automatically-tag-and-release-this-commit]
+          EOF
+
+          # Push the result to a branch and setup metadata for the step below
+          # that creates a PR
+          git push origin HEAD:ci/release-$cur
+          echo "PR_HEAD=ci/release-$cur" >> $GITHUB_ENV
+          echo "PR_TITLE=Release Wasmtime $cur" >> $GITHUB_ENV
+          echo "PR_BASE=release-$cur" >> $GITHUB_ENV
+          cat > pr-body <<-EOF
+          This is an [automated pull request][process] from CI which is
+          intended to notify maintainers that it's time to release Wasmtime
+          $cur. The [release branch][branch] was created roughly two weeks ago
+          and it's now time for it to be published and released.
+
+          It's recommended that maintainers double-check that [RELEASES.md]
+          is up-to-date and that there are no known issues before merging this
+          PR. When this PR is merged a release tag will automatically be
+          created, crates will be published, and CI artifacts will be produced.
+
+          [RELEASES.md]: https://github.com/${{ github.repository }}/blob/main/RELEASES.md
+          [process]: https://docs.wasmtime.dev/contributing-release-process.html
+          [branch]: https://github.com/${{ github.repository }}/tree/release-$cur
+          EOF
+        if: >-
+          github.event.schedule == '0 0 20 * *' ||
+          github.event.inputs.action == 'release-latest'
+
+      - name: Bump and release patch version number
+        run: |
+          # Update version numbers on a patch basis and update RELEASES.md if a
+          # patch release marker is already in there. Note that this commit
+          # message indicates that on-merge a release will be made.
+          ./publish bump-patch
+          sed -i "s/^Unreleased/Released $(date +'%Y-%m-%d')/" RELEASES.md
+          num=$(./ci/print-current-version.sh)
+          git commit -a -F-<<EOF
+          Release Wasmtime $num
+
+          [automatically-tag-and-release-this-commit]
+          EOF
+
+          # Push the result to a branch and setup metadata for the step below
+          # that creates a PR
+          git push origin HEAD:ci/bump-to-$num
+          echo "PR_HEAD=ci/bump-to-$num" >> $GITHUB_ENV
+          echo "PR_TITLE=Release Wasmtime $num" >> $GITHUB_ENV
+          echo "PR_BASE=${{ github.ref_name }}" >> $GITHUB_ENV
+          cat > pr-body <<-EOF
+          This is an [automated pull request][process] from CI to create a patch
+          release for Wasmtime $num, requested by @${{ github.actor }}.
+
+          It's recommended that maintainers double-check that [RELEASES.md]
+          is up-to-date and that there are no known issues before merging this
+          PR. When this PR is merged a release tag will automatically be
+          created, crates will be published, and CI artifacts will be produced.
+
+          [RELEASES.md]: https://github.com/${{ github.repository }}/blob/main/RELEASES.md
+          [process]: https://docs.wasmtime.dev/contributing-release-process.html
+          EOF
+
+        if: github.event.inputs.action == 'release-patch'
+
+      - name: Make a PR
+        # Note that the syntax here is kinda funky, and the general gist is that
+        # I couldn't figure out a good way to have a multiline string-literal
+        # become a json-encoded string literal to send to GitHub. This
+        # represents my best attempt.
+        run: |
+          body=$(jq -sR < ./pr-body)
+
+          curl --include --request POST \
+            https://api.github.com/repos/${{ github.repository }}/pulls \
+            --header "Authorization: token ${{ secrets.PERSONAL_ACCESS_TOKEN }}" \
+            --data @- << EOF
+          {
+            "head": "$PR_HEAD",
+            "base": "$PR_BASE",
+            "title": "$PR_TITLE",
+            "body": $body,
+            "maintainer_can_modify": true
+
+          }
+          EOF
diff --git a/Cargo.lock b/Cargo.lock
index 36bc831c1f..9f6f690580 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -501,7 +501,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-codegen",
  "cranelift-frontend",
@@ -509,14 +509,14 @@ dependencies = [
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-entity",
 ]
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "bincode",
  "cranelift-bforest",
@@ -538,18 +538,18 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-codegen-shared",
 ]
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.82.0"
+version = "0.83.0"
 
 [[package]]
 name = "cranelift-entity"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "serde",
 ]
@@ -577,7 +577,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-codegen",
  "hashbrown 0.9.1",
@@ -597,7 +597,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-interpreter"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-codegen",
  "cranelift-entity",
@@ -610,7 +610,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "log",
  "miette",
@@ -620,7 +620,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-jit"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "anyhow",
  "cranelift",
@@ -639,7 +639,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-module"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -648,7 +648,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-native"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -657,7 +657,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-object"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -671,14 +671,14 @@ dependencies = [
 
 [[package]]
 name = "cranelift-preopt"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-codegen",
 ]
 
 [[package]]
 name = "cranelift-reader"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-codegen",
  "smallvec",
@@ -687,7 +687,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-serde"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "clap",
  "cranelift-codegen",
@@ -731,7 +731,7 @@ dependencies = [
 
 [[package]]
 name = "cranelift-wasm"
-version = "0.82.0"
+version = "0.83.0"
 dependencies = [
  "cranelift-codegen",
  "cranelift-entity",
@@ -3175,7 +3175,7 @@ checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
 
 [[package]]
 name = "wasi-cap-std-sync"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3198,7 +3198,7 @@ dependencies = [
 
 [[package]]
 name = "wasi-common"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "bitflags",
@@ -3243,7 +3243,7 @@ dependencies = [
 
 [[package]]
 name = "wasi-tokio"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "cap-std",
@@ -3401,7 +3401,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3474,7 +3474,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-cache"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -3497,7 +3497,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-cli"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3539,7 +3539,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-cranelift"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
@@ -3559,7 +3559,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-environ"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "cranelift-entity",
@@ -3577,7 +3577,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-fiber"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "backtrace",
  "cc",
@@ -3627,7 +3627,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-jit"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "addr2line",
  "anyhow",
@@ -3652,7 +3652,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-jit-debug"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "lazy_static",
  "object",
@@ -3661,7 +3661,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-runtime"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "backtrace",
@@ -3687,7 +3687,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-types"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "cranelift-entity",
  "serde",
@@ -3697,7 +3697,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "wasi-cap-std-sync",
@@ -3709,7 +3709,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi-crypto"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "wasi-crypto",
@@ -3719,7 +3719,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wasi-nn"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "openvino",
@@ -3730,7 +3730,7 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-wast"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "wasmtime",
@@ -3789,7 +3789,7 @@ dependencies = [
 
 [[package]]
 name = "wiggle"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3806,7 +3806,7 @@ dependencies = [
 
 [[package]]
 name = "wiggle-generate"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "anyhow",
  "heck",
@@ -3819,7 +3819,7 @@ dependencies = [
 
 [[package]]
 name = "wiggle-macro"
-version = "0.35.0"
+version = "0.36.0"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/Cargo.toml b/Cargo.toml
index c226a56457..8766245a2a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-cli"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "Command-line interface for Wasmtime"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -21,14 +21,14 @@ path = "src/bin/wasmtime.rs"
 doc = false
 
 [dependencies]
-wasmtime = { path = "crates/wasmtime", version = "0.35.0", default-features = false, features = ['cache', 'cranelift'] }
-wasmtime-cache = { path = "crates/cache", version = "=0.35.0" }
-wasmtime-cranelift = { path = "crates/cranelift", version = "=0.35.0" }
-wasmtime-environ = { path = "crates/environ", version = "=0.35.0" }
-wasmtime-wast = { path = "crates/wast", version = "=0.35.0" }
-wasmtime-wasi = { path = "crates/wasi", version = "0.35.0" }
-wasmtime-wasi-crypto = { path = "crates/wasi-crypto", version = "0.35.0", optional = true }
-wasmtime-wasi-nn = { path = "crates/wasi-nn", version = "0.35.0", optional = true }
+wasmtime = { path = "crates/wasmtime", version = "0.36.0", default-features = false, features = ['cache', 'cranelift'] }
+wasmtime-cache = { path = "crates/cache", version = "=0.36.0" }
+wasmtime-cranelift = { path = "crates/cranelift", version = "=0.36.0" }
+wasmtime-environ = { path = "crates/environ", version = "=0.36.0" }
+wasmtime-wast = { path = "crates/wast", version = "=0.36.0" }
+wasmtime-wasi = { path = "crates/wasi", version = "0.36.0" }
+wasmtime-wasi-crypto = { path = "crates/wasi-crypto", version = "0.36.0", optional = true }
+wasmtime-wasi-nn = { path = "crates/wasi-nn", version = "0.36.0", optional = true }
 structopt = { version = "0.3.5", features = ["color", "suggestions"] }
 anyhow = "1.0.19"
 target-lexicon = { version = "0.12.0", default-features = false }
@@ -46,7 +46,7 @@ rustix = "0.33.5"
 
 [dev-dependencies]
 # depend again on wasmtime to activate its default features for tests
-wasmtime = { path = "crates/wasmtime", version = "0.35.0" }
+wasmtime = { path = "crates/wasmtime", version = "0.36.0" }
 env_logger = "0.8.1"
 filecheck = "0.5.0"
 more-asserts = "0.2.1"
diff --git a/RELEASES.md b/RELEASES.md
index 2030be863b..b05801ee8b 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -1,5 +1,3 @@
-# Wasmtime Releases
-
 --------------------------------------------------------------------------------
 
 ## 0.36.0
diff --git a/ci/RELEASES-template.md b/ci/RELEASES-template.md
new file mode 100644
index 0000000000..f4c86db847
--- /dev/null
+++ b/ci/RELEASES-template.md
@@ -0,0 +1,10 @@
+--------------------------------------------------------------------------------
+
+## VERSION
+
+Unreleased.
+
+### Added
+
+### Changed
+
diff --git a/ci/print-current-version.sh b/ci/print-current-version.sh
new file mode 100755
index 0000000000..348b8ce580
--- /dev/null
+++ b/ci/print-current-version.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+grep '^version =' Cargo.toml | head -n 1 | sed 's/.*"\(.*\)"/\1/'
diff --git a/cranelift/Cargo.toml b/cranelift/Cargo.toml
index c6522bef22..a63e619b6f 100644
--- a/cranelift/Cargo.toml
+++ b/cranelift/Cargo.toml
@@ -15,19 +15,19 @@ path = "src/clif-util.rs"
 
 [dependencies]
 cfg-if = "1.0"
-cranelift-codegen = { path = "codegen", version = "0.82.0" }
-cranelift-entity = { path = "entity", version = "0.82.0" }
-cranelift-interpreter = { path = "interpreter", version = "0.82.0" }
-cranelift-reader = { path = "reader", version = "0.82.0" }
-cranelift-frontend = { path = "frontend", version = "0.82.0" }
-cranelift-wasm = { path = "wasm", version = "0.82.0", optional = true }
-cranelift-native = { path = "native", version = "0.82.0" }
+cranelift-codegen = { path = "codegen", version = "0.83.0" }
+cranelift-entity = { path = "entity", version = "0.83.0" }
+cranelift-interpreter = { path = "interpreter", version = "0.83.0" }
+cranelift-reader = { path = "reader", version = "0.83.0" }
+cranelift-frontend = { path = "frontend", version = "0.83.0" }
+cranelift-wasm = { path = "wasm", version = "0.83.0", optional = true }
+cranelift-native = { path = "native", version = "0.83.0" }
 cranelift-filetests = { path = "filetests", version = "0.73.0" }
-cranelift-module = { path = "module", version = "0.82.0" }
-cranelift-object = { path = "object", version = "0.82.0" }
-cranelift-jit = { path = "jit", version = "0.82.0" }
-cranelift-preopt = { path = "preopt", version = "0.82.0" }
-cranelift = { path = "umbrella", version = "0.82.0" }
+cranelift-module = { path = "module", version = "0.83.0" }
+cranelift-object = { path = "object", version = "0.83.0" }
+cranelift-jit = { path = "jit", version = "0.83.0" }
+cranelift-preopt = { path = "preopt", version = "0.83.0" }
+cranelift = { path = "umbrella", version = "0.83.0" }
 filecheck = "0.5.0"
 log = "0.4.8"
 termcolor = "1.1.2"
diff --git a/cranelift/bforest/Cargo.toml b/cranelift/bforest/Cargo.toml
index 552102afc1..cbbee192f5 100644
--- a/cranelift/bforest/Cargo.toml
+++ b/cranelift/bforest/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-bforest"
-version = "0.82.0"
+version = "0.83.0"
 description = "A forest of B+-trees"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-bforest"
@@ -12,7 +12,7 @@ keywords = ["btree", "forest", "set", "map"]
 edition = "2018"
 
 [dependencies]
-cranelift-entity = { path = "../entity", version = "0.82.0", default-features = false }
+cranelift-entity = { path = "../entity", version = "0.83.0", default-features = false }
 
 [badges]
 maintenance = { status = "experimental" }
diff --git a/cranelift/codegen/Cargo.toml b/cranelift/codegen/Cargo.toml
index 757d9dd123..cb6f352d5b 100644
--- a/cranelift/codegen/Cargo.toml
+++ b/cranelift/codegen/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-codegen"
-version = "0.82.0"
+version = "0.83.0"
 description = "Low-level code generator library"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-codegen"
@@ -13,9 +13,9 @@ build = "build.rs"
 edition = "2018"
 
 [dependencies]
-cranelift-codegen-shared = { path = "./shared", version = "0.82.0" }
-cranelift-entity = { path = "../entity", version = "0.82.0" }
-cranelift-bforest = { path = "../bforest", version = "0.82.0" }
+cranelift-codegen-shared = { path = "./shared", version = "0.83.0" }
+cranelift-entity = { path = "../entity", version = "0.83.0" }
+cranelift-bforest = { path = "../bforest", version = "0.83.0" }
 hashbrown = { version = "0.9.1", optional = true }
 target-lexicon = "0.12"
 log = { version = "0.4.6", default-features = false }
@@ -34,8 +34,8 @@ souper-ir = { version = "2.1.0", optional = true }
 criterion = "0.3"
 
 [build-dependencies]
-cranelift-codegen-meta = { path = "meta", version = "0.82.0" }
-cranelift-isle = { path = "../isle/isle", version = "=0.82.0", optional = true }
+cranelift-codegen-meta = { path = "meta", version = "0.83.0" }
+cranelift-isle = { path = "../isle/isle", version = "=0.83.0", optional = true }
 miette = { version = "3", features = ["fancy"], optional = true }
 
 [features]
diff --git a/cranelift/codegen/meta/Cargo.toml b/cranelift/codegen/meta/Cargo.toml
index bb7c0efffb..a50b3ea7a5 100644
--- a/cranelift/codegen/meta/Cargo.toml
+++ b/cranelift/codegen/meta/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "cranelift-codegen-meta"
 authors = ["The Cranelift Project Developers"]
-version = "0.82.0"
+version = "0.83.0"
 description = "Metaprogram for cranelift-codegen code generator library"
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/bytecodealliance/wasmtime"
@@ -13,7 +13,7 @@ edition = "2018"
 # rustdoc-args = [ "--document-private-items" ]
 
 [dependencies]
-cranelift-codegen-shared = { path = "../shared", version = "0.82.0" }
+cranelift-codegen-shared = { path = "../shared", version = "0.83.0" }
 
 [badges]
 maintenance = { status = "experimental" }
diff --git a/cranelift/codegen/shared/Cargo.toml b/cranelift/codegen/shared/Cargo.toml
index 64b3ca6b7c..d11c470b4a 100644
--- a/cranelift/codegen/shared/Cargo.toml
+++ b/cranelift/codegen/shared/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-codegen-shared"
-version = "0.82.0"
+version = "0.83.0"
 description = "For code shared between cranelift-codegen-meta and cranelift-codegen"
 license = "Apache-2.0 WITH LLVM-exception"
 repository = "https://github.com/bytecodealliance/wasmtime"
diff --git a/cranelift/entity/Cargo.toml b/cranelift/entity/Cargo.toml
index fc530d7cad..a9ee8e3ebf 100644
--- a/cranelift/entity/Cargo.toml
+++ b/cranelift/entity/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-entity"
-version = "0.82.0"
+version = "0.83.0"
 description = "Data structures using entity references as mapping keys"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-entity"
diff --git a/cranelift/filetests/Cargo.toml b/cranelift/filetests/Cargo.toml
index 8c4550e84a..2f843f6b7f 100644
--- a/cranelift/filetests/Cargo.toml
+++ b/cranelift/filetests/Cargo.toml
@@ -10,12 +10,12 @@ publish = false
 edition = "2018"
 
 [dependencies]
-cranelift-codegen = { path = "../codegen", version = "0.82.0", features = ["testing_hooks"] }
-cranelift-frontend = { path = "../frontend", version = "0.82.0" }
-cranelift-interpreter = { path = "../interpreter", version = "0.82.0" }
-cranelift-native = { path = "../native", version = "0.82.0" }
-cranelift-reader = { path = "../reader", version = "0.82.0" }
-cranelift-preopt = { path = "../preopt", version = "0.82.0" }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", features = ["testing_hooks"] }
+cranelift-frontend = { path = "../frontend", version = "0.83.0" }
+cranelift-interpreter = { path = "../interpreter", version = "0.83.0" }
+cranelift-native = { path = "../native", version = "0.83.0" }
+cranelift-reader = { path = "../reader", version = "0.83.0" }
+cranelift-preopt = { path = "../preopt", version = "0.83.0" }
 file-per-thread-logger = "0.1.2"
 filecheck = "0.5.0"
 gimli = { version = "0.26.0", default-features = false, features = ["read"] }
diff --git a/cranelift/frontend/Cargo.toml b/cranelift/frontend/Cargo.toml
index f108866f5f..04a329eb3f 100644
--- a/cranelift/frontend/Cargo.toml
+++ b/cranelift/frontend/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-frontend"
-version = "0.82.0"
+version = "0.83.0"
 description = "Cranelift IR builder helper"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-frontend"
@@ -11,7 +11,7 @@ readme = "README.md"
 edition = "2018"
 
 [dependencies]
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false }
 target-lexicon = "0.12"
 log = { version = "0.4.6", default-features = false }
 hashbrown = { version = "0.9.1", optional = true }
diff --git a/cranelift/fuzzgen/Cargo.toml b/cranelift/fuzzgen/Cargo.toml
index cd5d2be20c..4b1661c9d4 100644
--- a/cranelift/fuzzgen/Cargo.toml
+++ b/cranelift/fuzzgen/Cargo.toml
@@ -11,7 +11,7 @@ publish = false
 
 
 [dependencies]
-cranelift = { path = "../umbrella", version = "0.82.0" }
+cranelift = { path = "../umbrella", version = "0.83.0" }
 
 anyhow = "1.0.19"
 arbitrary = "1.0.0"
diff --git a/cranelift/interpreter/Cargo.toml b/cranelift/interpreter/Cargo.toml
index 6cf4adbd11..fb73c8a59b 100644
--- a/cranelift/interpreter/Cargo.toml
+++ b/cranelift/interpreter/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-interpreter"
-version = "0.82.0"
+version = "0.83.0"
 authors = ["The Cranelift Project Developers"]
 description = "Interpret Cranelift IR"
 repository = "https://github.com/bytecodealliance/wasmtime"
@@ -11,15 +11,15 @@ readme = "README.md"
 edition = "2018"
 
 [dependencies]
-cranelift-codegen = { path = "../codegen", version = "0.82.0" }
-cranelift-entity = { path = "../entity", version = "0.82.0" }
+cranelift-codegen = { path = "../codegen", version = "0.83.0" }
+cranelift-entity = { path = "../entity", version = "0.83.0" }
 log = { version = "0.4.8", default-features = false }
 smallvec = "1.6.1"
 thiserror = "1.0.15"
 
 [dev-dependencies]
-cranelift-frontend = { path = "../frontend", version = "0.82.0" }
-cranelift-reader = { path = "../reader", version = "0.82.0" }
+cranelift-frontend = { path = "../frontend", version = "0.83.0" }
+cranelift-reader = { path = "../reader", version = "0.83.0" }
 
 [badges]
 maintenance = { status = "experimental" }
diff --git a/cranelift/isle/isle/Cargo.toml b/cranelift/isle/isle/Cargo.toml
index b29318f0ec..c884180d1c 100644
--- a/cranelift/isle/isle/Cargo.toml
+++ b/cranelift/isle/isle/Cargo.toml
@@ -6,7 +6,7 @@ license = "Apache-2.0 WITH LLVM-exception"
 name = "cranelift-isle"
 readme = "../README.md"
 repository = "https://github.com/bytecodealliance/wasmtime/tree/main/cranelift/isle"
-version = "0.82.0"
+version = "0.83.0"
 
 [dependencies]
 log = "0.4"
diff --git a/cranelift/jit/Cargo.toml b/cranelift/jit/Cargo.toml
index 467bed437f..67ef9e2a60 100644
--- a/cranelift/jit/Cargo.toml
+++ b/cranelift/jit/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-jit"
-version = "0.82.0"
+version = "0.83.0"
 authors = ["The Cranelift Project Developers"]
 description = "A JIT library backed by Cranelift"
 repository = "https://github.com/bytecodealliance/wasmtime"
@@ -10,10 +10,10 @@ readme = "README.md"
 edition = "2018"
 
 [dependencies]
-cranelift-module = { path = "../module", version = "0.82.0" }
-cranelift-native = { path = "../native", version = "0.82.0" }
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false, features = ["std"] }
-cranelift-entity = { path = "../entity", version = "0.82.0" }
+cranelift-module = { path = "../module", version = "0.83.0" }
+cranelift-native = { path = "../native", version = "0.83.0" }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false, features = ["std"] }
+cranelift-entity = { path = "../entity", version = "0.83.0" }
 anyhow = "1.0"
 region = "2.2.0"
 libc = { version = "0.2.42" }
@@ -29,9 +29,9 @@ selinux-fix = ['memmap2']
 default = []
 
 [dev-dependencies]
-cranelift = { path = "../umbrella", version = "0.82.0" }
-cranelift-frontend = { path = "../frontend", version = "0.82.0" }
-cranelift-entity = { path = "../entity", version = "0.82.0" }
+cranelift = { path = "../umbrella", version = "0.83.0" }
+cranelift-frontend = { path = "../frontend", version = "0.83.0" }
+cranelift-entity = { path = "../entity", version = "0.83.0" }
 
 [badges]
 maintenance = { status = "experimental" }
diff --git a/cranelift/module/Cargo.toml b/cranelift/module/Cargo.toml
index a4807b45a3..2605f48044 100644
--- a/cranelift/module/Cargo.toml
+++ b/cranelift/module/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-module"
-version = "0.82.0"
+version = "0.83.0"
 authors = ["The Cranelift Project Developers"]
 description = "Support for linking functions and data with Cranelift"
 repository = "https://github.com/bytecodealliance/wasmtime"
@@ -11,7 +11,7 @@ readme = "README.md"
 edition = "2018"
 
 [dependencies]
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false }
 hashbrown = { version = "0.9.1", optional = true }
 anyhow = "1.0"
 
diff --git a/cranelift/native/Cargo.toml b/cranelift/native/Cargo.toml
index 89d330bc8a..99db7940b8 100644
--- a/cranelift/native/Cargo.toml
+++ b/cranelift/native/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-native"
-version = "0.82.0"
+version = "0.83.0"
 authors = ["The Cranelift Project Developers"]
 description = "Support for targeting the host with Cranelift"
 documentation = "https://docs.rs/cranelift-native"
@@ -11,7 +11,7 @@ readme = "README.md"
 edition = "2018"
 
 [dependencies]
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false }
 target-lexicon = "0.12"
 
 [target.'cfg(target_arch = "s390x")'.dependencies]
diff --git a/cranelift/object/Cargo.toml b/cranelift/object/Cargo.toml
index c01af135d8..f925dbe72c 100644
--- a/cranelift/object/Cargo.toml
+++ b/cranelift/object/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-object"
-version = "0.82.0"
+version = "0.83.0"
 authors = ["The Cranelift Project Developers"]
 description = "Emit Cranelift output to native object files with `object`"
 repository = "https://github.com/bytecodealliance/wasmtime"
@@ -10,16 +10,16 @@ readme = "README.md"
 edition = "2018"
 
 [dependencies]
-cranelift-module = { path = "../module", version = "0.82.0" }
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false, features = ["std"] }
+cranelift-module = { path = "../module", version = "0.83.0" }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false, features = ["std"] }
 object = { version = "0.27.0", default-features = false, features = ["write"] }
 target-lexicon = "0.12"
 anyhow = "1.0"
 log = { version = "0.4.6", default-features = false }
 
 [dev-dependencies]
-cranelift-frontend = { path = "../frontend", version = "0.82.0" }
-cranelift-entity = { path = "../entity", version = "0.82.0" }
+cranelift-frontend = { path = "../frontend", version = "0.83.0" }
+cranelift-entity = { path = "../entity", version = "0.83.0" }
 
 [badges]
 maintenance = { status = "experimental" }
diff --git a/cranelift/preopt/Cargo.toml b/cranelift/preopt/Cargo.toml
index 05f955e9a9..a779cbaa95 100644
--- a/cranelift/preopt/Cargo.toml
+++ b/cranelift/preopt/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-preopt"
-version = "0.82.0"
+version = "0.83.0"
 description = "Support for optimizations in Cranelift"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-preopt"
@@ -12,7 +12,7 @@ keywords = ["optimize", "compile", "compiler", "jit"]
 edition = "2018"
 
 [dependencies]
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false }
 # This is commented out because it doesn't build on Rust 1.25.0, which
 # cranelift currently supports.
 # rustc_apfloat = { version = "0.1.2", default-features = false }
diff --git a/cranelift/reader/Cargo.toml b/cranelift/reader/Cargo.toml
index c9c3fc053f..37a52b46a1 100644
--- a/cranelift/reader/Cargo.toml
+++ b/cranelift/reader/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift-reader"
-version = "0.82.0"
+version = "0.83.0"
 description = "Cranelift textual IR reader"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift-reader"
@@ -10,7 +10,7 @@ readme = "README.md"
 edition = "2018"
 
 [dependencies]
-cranelift-codegen = { path = "../codegen", version = "0.82.0" }
+cranelift-codegen = { path = "../codegen", version = "0.83.0" }
 smallvec = "1.6.1"
 target-lexicon = "0.12"
 
diff --git a/cranelift/serde/Cargo.toml b/cranelift/serde/Cargo.toml
index 918688ab47..a71bd8b349 100644
--- a/cranelift/serde/Cargo.toml
+++ b/cranelift/serde/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-serde"
-version = "0.82.0"
+version = "0.83.0"
 authors = ["The Cranelift Project Developers"]
 description = "Serializer/Deserializer for Cranelift IR"
 repository = "https://github.com/bytecodealliance/wasmtime"
@@ -16,8 +16,8 @@ path = "src/clif-json.rs"
 [dependencies]
 clap = "2.32.0"
 serde_json = "1.0.26"
-cranelift-codegen = { path = "../codegen", version = "0.82.0", features = ["enable-serde"] }
-cranelift-reader = { path = "../reader", version = "0.82.0" }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", features = ["enable-serde"] }
+cranelift-reader = { path = "../reader", version = "0.83.0" }
 
 [badges]
 maintenance = { status = "experimental" }
diff --git a/cranelift/umbrella/Cargo.toml b/cranelift/umbrella/Cargo.toml
index ef3f939adc..185fcf2f2a 100644
--- a/cranelift/umbrella/Cargo.toml
+++ b/cranelift/umbrella/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cranelift Project Developers"]
 name = "cranelift"
-version = "0.82.0"
+version = "0.83.0"
 description = "Umbrella for commonly-used cranelift crates"
 license = "Apache-2.0 WITH LLVM-exception"
 documentation = "https://docs.rs/cranelift"
@@ -12,8 +12,8 @@ keywords = ["compile", "compiler", "jit"]
 edition = "2018"
 
 [dependencies]
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false }
-cranelift-frontend = { path = "../frontend", version = "0.82.0", default-features = false }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false }
+cranelift-frontend = { path = "../frontend", version = "0.83.0", default-features = false }
 
 [features]
 default = ["std"]
diff --git a/cranelift/wasm/Cargo.toml b/cranelift/wasm/Cargo.toml
index 0cee3c0707..959f88a5eb 100644
--- a/cranelift/wasm/Cargo.toml
+++ b/cranelift/wasm/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cranelift-wasm"
-version = "0.82.0"
+version = "0.83.0"
 authors = ["The Cranelift Project Developers"]
 description = "Translator from WebAssembly to Cranelift IR"
 documentation = "https://docs.rs/cranelift-wasm"
@@ -13,10 +13,10 @@ edition = "2018"
 
 [dependencies]
 wasmparser = { version = "0.83.0", default-features = false }
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false }
-cranelift-entity = { path = "../entity", version = "0.82.0" }
-cranelift-frontend = { path = "../frontend", version = "0.82.0", default-features = false }
-wasmtime-types = { path = "../../crates/types", version = "0.35.0" }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false }
+cranelift-entity = { path = "../entity", version = "0.83.0" }
+cranelift-frontend = { path = "../frontend", version = "0.83.0", default-features = false }
+wasmtime-types = { path = "../../crates/types", version = "0.36.0" }
 hashbrown = { version = "0.9.1", optional = true }
 itertools = "0.10.0"
 log = { version = "0.4.6", default-features = false }
@@ -26,7 +26,7 @@ smallvec = "1.6.1"
 [dev-dependencies]
 wat = "1.0.37"
 target-lexicon = "0.12"
-cranelift-codegen = { path = "../codegen", version = "0.82.0", default-features = false }
+cranelift-codegen = { path = "../codegen", version = "0.83.0", default-features = false }
 
 [features]
 default = ["std"]
diff --git a/crates/cache/Cargo.toml b/crates/cache/Cargo.toml
index c6a5b8c3b9..e86e5653ad 100644
--- a/crates/cache/Cargo.toml
+++ b/crates/cache/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-cache"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "Support for automatic module caching with Wasmtime"
 license = "Apache-2.0 WITH LLVM-exception"
diff --git a/crates/cranelift/Cargo.toml b/crates/cranelift/Cargo.toml
index a337bcfe3f..0111e827be 100644
--- a/crates/cranelift/Cargo.toml
+++ b/crates/cranelift/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-cranelift"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "Integration between Cranelift and Wasmtime"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -13,12 +13,12 @@ edition = "2021"
 [dependencies]
 anyhow = "1.0"
 log = "0.4"
-wasmtime-environ = { path = "../environ", version = "=0.35.0" }
-cranelift-wasm = { path = "../../cranelift/wasm", version = "0.82.0" }
-cranelift-codegen = { path = "../../cranelift/codegen", version = "0.82.0" }
-cranelift-frontend = { path = "../../cranelift/frontend", version = "0.82.0" }
-cranelift-entity = { path = "../../cranelift/entity", version = "0.82.0" }
-cranelift-native = { path = "../../cranelift/native", version = "0.82.0" }
+wasmtime-environ = { path = "../environ", version = "=0.36.0" }
+cranelift-wasm = { path = "../../cranelift/wasm", version = "0.83.0" }
+cranelift-codegen = { path = "../../cranelift/codegen", version = "0.83.0" }
+cranelift-frontend = { path = "../../cranelift/frontend", version = "0.83.0" }
+cranelift-entity = { path = "../../cranelift/entity", version = "0.83.0" }
+cranelift-native = { path = "../../cranelift/native", version = "0.83.0" }
 wasmparser = "0.83.0"
 target-lexicon = "0.12"
 gimli = { version = "0.26.0", default-features = false, features = ['read', 'std'] }
diff --git a/crates/environ/Cargo.toml b/crates/environ/Cargo.toml
index 74c5bd9094..61baa9a257 100644
--- a/crates/environ/Cargo.toml
+++ b/crates/environ/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-environ"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "Standalone environment support for WebAsssembly code in Cranelift"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -12,8 +12,8 @@ edition = "2018"
 
 [dependencies]
 anyhow = "1.0"
-cranelift-entity = { path = "../../cranelift/entity", version = "0.82.0" }
-wasmtime-types = { path = "../types", version = "0.35.0" }
+cranelift-entity = { path = "../../cranelift/entity", version = "0.83.0" }
+wasmtime-types = { path = "../types", version = "0.36.0" }
 wasmparser = "0.83.0"
 indexmap = { version = "1.0.2", features = ["serde-1"] }
 thiserror = "1.0.4"
diff --git a/crates/fiber/Cargo.toml b/crates/fiber/Cargo.toml
index 085fb3bd32..60076fc7f1 100644
--- a/crates/fiber/Cargo.toml
+++ b/crates/fiber/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-fiber"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "Fiber support for Wasmtime"
 license = "Apache-2.0 WITH LLVM-exception"
diff --git a/crates/jit-debug/Cargo.toml b/crates/jit-debug/Cargo.toml
index 309fb19b6f..cb4594c7b0 100644
--- a/crates/jit-debug/Cargo.toml
+++ b/crates/jit-debug/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-jit-debug"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "JIT debug interfaces support for Wasmtime"
 license = "Apache-2.0 WITH LLVM-exception"
diff --git a/crates/jit/Cargo.toml b/crates/jit/Cargo.toml
index 1c9a874af6..ae0f95ca47 100644
--- a/crates/jit/Cargo.toml
+++ b/crates/jit/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-jit"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "JIT-style execution for WebAsssembly code in Cranelift"
 documentation = "https://docs.rs/wasmtime-jit"
@@ -11,9 +11,9 @@ repository = "https://github.com/bytecodealliance/wasmtime"
 edition = "2018"
 
 [dependencies]
-wasmtime-environ = { path = "../environ", version = "=0.35.0" }
-wasmtime-jit-debug = { path = "../jit-debug", version = "=0.35.0", features = ["perf_jitdump"], optional = true }
-wasmtime-runtime = { path = "../runtime", version = "=0.35.0" }
+wasmtime-environ = { path = "../environ", version = "=0.36.0" }
+wasmtime-jit-debug = { path = "../jit-debug", version = "=0.36.0", features = ["perf_jitdump"], optional = true }
+wasmtime-runtime = { path = "../runtime", version = "=0.36.0" }
 region = "2.2.0"
 thiserror = "1.0.4"
 target-lexicon = { version = "0.12.0", default-features = false }
diff --git a/crates/runtime/Cargo.toml b/crates/runtime/Cargo.toml
index c9dd3f7f53..54838fca40 100644
--- a/crates/runtime/Cargo.toml
+++ b/crates/runtime/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-runtime"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "Runtime library support for Wasmtime"
 documentation = "https://docs.rs/wasmtime-runtime"
@@ -11,9 +11,9 @@ repository = "https://github.com/bytecodealliance/wasmtime"
 edition = "2018"
 
 [dependencies]
-wasmtime-environ = { path = "../environ", version = "=0.35.0" }
-wasmtime-fiber = { path = "../fiber", version = "=0.35.0", optional = true }
-wasmtime-jit-debug = { path = "../jit-debug", version = "=0.35.0", features = ["gdb_jit_int"] }
+wasmtime-environ = { path = "../environ", version = "=0.36.0" }
+wasmtime-fiber = { path = "../fiber", version = "=0.36.0", optional = true }
+wasmtime-jit-debug = { path = "../jit-debug", version = "=0.36.0", features = ["gdb_jit_int"] }
 region = "2.1.0"
 libc = { version = "0.2.112", default-features = false }
 log = "0.4.8"
diff --git a/crates/test-programs/Cargo.toml b/crates/test-programs/Cargo.toml
index 598e3e5cf4..432e63a418 100644
--- a/crates/test-programs/Cargo.toml
+++ b/crates/test-programs/Cargo.toml
@@ -11,10 +11,10 @@ license = "Apache-2.0 WITH LLVM-exception"
 cfg-if = "1.0"
 
 [dev-dependencies]
-wasi-common = { path = "../wasi-common", version = "0.35.0" }
-wasi-cap-std-sync = { path = "../wasi-common/cap-std-sync", version = "0.35.0" }
-wasmtime = { path = "../wasmtime", version = "0.35.0" }
-wasmtime-wasi = { path = "../wasi", version = "0.35.0", features = ["tokio"] }
+wasi-common = { path = "../wasi-common", version = "0.36.0" }
+wasi-cap-std-sync = { path = "../wasi-common/cap-std-sync", version = "0.36.0" }
+wasmtime = { path = "../wasmtime", version = "0.36.0" }
+wasmtime-wasi = { path = "../wasi", version = "0.36.0", features = ["tokio"] }
 target-lexicon = "0.12.0"
 pretty_env_logger = "0.4.0"
 tempfile = "3.1.0"
diff --git a/crates/types/Cargo.toml b/crates/types/Cargo.toml
index dd257c1b18..89165e7936 100644
--- a/crates/types/Cargo.toml
+++ b/crates/types/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-types"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "WebAssembly type definitions for Cranelift"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -9,7 +9,7 @@ documentation = "https://docs.rs/wasmtime-types"
 edition = "2018"
 
 [dependencies]
-cranelift-entity = { path = "../../cranelift/entity", version = "0.82.0", features = ['enable-serde'] }
+cranelift-entity = { path = "../../cranelift/entity", version = "0.83.0", features = ['enable-serde'] }
 serde = { version = "1.0.94", features = ["derive"] }
 thiserror = "1.0.4"
 wasmparser = { version = "0.83.0", default-features = false }
diff --git a/crates/wasi-common/Cargo.toml b/crates/wasi-common/Cargo.toml
index 81774a82f4..c8d641e714 100644
--- a/crates/wasi-common/Cargo.toml
+++ b/crates/wasi-common/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasi-common"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "WASI implementation in Rust"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -20,7 +20,7 @@ links = "wasi-common-19"
 [dependencies]
 anyhow = "1.0"
 thiserror = "1.0"
-wiggle = { path = "../wiggle", default-features = false, version = "=0.35.0" }
+wiggle = { path = "../wiggle", default-features = false, version = "=0.36.0" }
 tracing = "0.1.19"
 cap-std = "0.24.1"
 cap-rand = "0.24.1"
diff --git a/crates/wasi-common/cap-std-sync/Cargo.toml b/crates/wasi-common/cap-std-sync/Cargo.toml
index 5bfc9c3b89..bd9eff831e 100644
--- a/crates/wasi-common/cap-std-sync/Cargo.toml
+++ b/crates/wasi-common/cap-std-sync/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasi-cap-std-sync"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "WASI implementation in Rust"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -12,7 +12,7 @@ edition = "2018"
 include = ["src/**/*", "README.md", "LICENSE" ]
 
 [dependencies]
-wasi-common = { path = "../", version = "=0.35.0" }
+wasi-common = { path = "../", version = "=0.36.0" }
 async-trait = "0.1"
 anyhow = "1.0"
 cap-std = "0.24.1"
diff --git a/crates/wasi-common/tokio/Cargo.toml b/crates/wasi-common/tokio/Cargo.toml
index 03510eb1a3..b904bd0c05 100644
--- a/crates/wasi-common/tokio/Cargo.toml
+++ b/crates/wasi-common/tokio/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasi-tokio"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "WASI implementation in Rust"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -11,9 +11,9 @@ edition = "2018"
 include = ["src/**/*", "LICENSE" ]
 
 [dependencies]
-wasi-common = { path = "../", version = "=0.35.0" }
-wasi-cap-std-sync = { path = "../cap-std-sync", version = "=0.35.0" }
-wiggle = { path = "../../wiggle", version = "=0.35.0" }
+wasi-common = { path = "../", version = "=0.36.0" }
+wasi-cap-std-sync = { path = "../cap-std-sync", version = "=0.36.0" }
+wiggle = { path = "../../wiggle", version = "=0.36.0" }
 tokio = { version = "1.8.0", features = [ "rt", "fs", "time", "io-util", "net", "io-std", "rt-multi-thread"] }
 cap-std = "0.24.1"
 anyhow = "1"
diff --git a/crates/wasi-crypto/Cargo.toml b/crates/wasi-crypto/Cargo.toml
index ff95acaeb6..3151f2ec4c 100644
--- a/crates/wasi-crypto/Cargo.toml
+++ b/crates/wasi-crypto/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-wasi-crypto"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "Wasmtime implementation of the wasi-crypto API"
 documentation = "https://docs.rs/wasmtime-wasi-crypto"
@@ -14,8 +14,8 @@ edition = "2018"
 [dependencies]
 anyhow = "1.0"
 wasi-crypto = { path = "spec/implementations/hostcalls/rust", version = "0.1.5" }
-wasmtime = { path = "../wasmtime", version = "0.35.0", default-features = false }
-wiggle = { path = "../wiggle", version = "=0.35.0" }
+wasmtime = { path = "../wasmtime", version = "0.36.0", default-features = false }
+wiggle = { path = "../wiggle", version = "=0.36.0" }
 
 [badges]
 maintenance = { status = "experimental" }
diff --git a/crates/wasi-nn/Cargo.toml b/crates/wasi-nn/Cargo.toml
index b594774ca5..91c773d91e 100644
--- a/crates/wasi-nn/Cargo.toml
+++ b/crates/wasi-nn/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-wasi-nn"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "Wasmtime implementation of the wasi-nn API"
 documentation = "https://docs.rs/wasmtime-wasi-nn"
@@ -14,7 +14,7 @@ edition = "2018"
 [dependencies]
 # These dependencies are necessary for the witx-generation macros to work:
 anyhow = "1.0"
-wiggle = { path = "../wiggle", version = "=0.35.0" }
+wiggle = { path = "../wiggle", version = "=0.36.0" }
 
 # These dependencies are necessary for the wasi-nn implementation:
 openvino = { version = "0.3.3", features = ["runtime-linking"] }
diff --git a/crates/wasi/Cargo.toml b/crates/wasi/Cargo.toml
index 58fb018540..2bf3eaa297 100644
--- a/crates/wasi/Cargo.toml
+++ b/crates/wasi/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-wasi"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "WASI implementation in Rust"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -13,11 +13,11 @@ include = ["src/**/*", "README.md", "LICENSE", "build.rs"]
 build = "build.rs"
 
 [dependencies]
-wasi-common = { path = "../wasi-common", version = "=0.35.0" }
-wasi-cap-std-sync = { path = "../wasi-common/cap-std-sync", version = "=0.35.0", optional = true }
-wasi-tokio = { path = "../wasi-common/tokio", version = "=0.35.0", optional = true }
-wiggle = { path = "../wiggle", default-features = false, version = "=0.35.0", features = ["wasmtime_integration"] }
-wasmtime = { path = "../wasmtime", default-features = false, version = "0.35.0" }
+wasi-common = { path = "../wasi-common", version = "=0.36.0" }
+wasi-cap-std-sync = { path = "../wasi-common/cap-std-sync", version = "=0.36.0", optional = true }
+wasi-tokio = { path = "../wasi-common/tokio", version = "=0.36.0", optional = true }
+wiggle = { path = "../wiggle", default-features = false, version = "=0.36.0", features = ["wasmtime_integration"] }
+wasmtime = { path = "../wasmtime", default-features = false, version = "0.36.0" }
 anyhow = "1.0"
 
 [features]
diff --git a/crates/wasmtime/Cargo.toml b/crates/wasmtime/Cargo.toml
index 87d2fbb315..dbdc1c65b3 100644
--- a/crates/wasmtime/Cargo.toml
+++ b/crates/wasmtime/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "High-level API to expose the Wasmtime runtime"
 documentation = "https://docs.rs/wasmtime"
@@ -13,12 +13,12 @@ edition = "2018"
 rustdoc-args = ["--cfg", "nightlydoc"]
 
 [dependencies]
-wasmtime-runtime = { path = "../runtime", version = "=0.35.0" }
-wasmtime-environ = { path = "../environ", version = "=0.35.0" }
-wasmtime-jit = { path = "../jit", version = "=0.35.0" }
-wasmtime-cache = { path = "../cache", version = "=0.35.0", optional = true }
-wasmtime-fiber = { path = "../fiber", version = "=0.35.0", optional = true }
-wasmtime-cranelift = { path = "../cranelift", version = "=0.35.0", optional = true }
+wasmtime-runtime = { path = "../runtime", version = "=0.36.0" }
+wasmtime-environ = { path = "../environ", version = "=0.36.0" }
+wasmtime-jit = { path = "../jit", version = "=0.36.0" }
+wasmtime-cache = { path = "../cache", version = "=0.36.0", optional = true }
+wasmtime-fiber = { path = "../fiber", version = "=0.36.0", optional = true }
+wasmtime-cranelift = { path = "../cranelift", version = "=0.36.0", optional = true }
 target-lexicon = { version = "0.12.0", default-features = false }
 wasmparser = "0.83.0"
 anyhow = "1.0.19"
diff --git a/crates/wast/Cargo.toml b/crates/wast/Cargo.toml
index cedfc2949b..bb08763c08 100644
--- a/crates/wast/Cargo.toml
+++ b/crates/wast/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wasmtime-wast"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["The Wasmtime Project Developers"]
 description = "wast testing support for wasmtime"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -11,7 +11,7 @@ edition = "2018"
 
 [dependencies]
 anyhow = "1.0.19"
-wasmtime = { path = "../wasmtime", version = "0.35.0", default-features = false, features = ['cranelift'] }
+wasmtime = { path = "../wasmtime", version = "0.36.0", default-features = false, features = ['cranelift'] }
 wast = "39.0.0"
 
 [badges]
diff --git a/crates/wiggle/Cargo.toml b/crates/wiggle/Cargo.toml
index 95516f88b5..955c5ac98e 100644
--- a/crates/wiggle/Cargo.toml
+++ b/crates/wiggle/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wiggle"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["Pat Hickey <phickey@fastly.com>", "Jakub Konka <kubkonk@jakubkonka.com>", "Alex Crichton <alex@alexcrichton.com>"]
 edition = "2018"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -13,11 +13,11 @@ include = ["src/**/*", "README.md", "LICENSE"]
 [dependencies]
 thiserror = "1"
 witx = { path = "../wasi-common/WASI/tools/witx", version = "0.9.1", optional = true }
-wiggle-macro = { path = "macro", version = "=0.35.0" }
+wiggle-macro = { path = "macro", version = "=0.36.0" }
 tracing = "0.1.26"
 bitflags = "1.2"
 async-trait = "0.1.42"
-wasmtime = { path = "../wasmtime", version = "0.35.0", optional = true, default-features = false }
+wasmtime = { path = "../wasmtime", version = "0.36.0", optional = true, default-features = false }
 anyhow = "1.0"
 
 [badges]
diff --git a/crates/wiggle/generate/Cargo.toml b/crates/wiggle/generate/Cargo.toml
index ab419e4476..6e12f47125 100644
--- a/crates/wiggle/generate/Cargo.toml
+++ b/crates/wiggle/generate/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wiggle-generate"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["Pat Hickey <phickey@fastly.com>", "Jakub Konka <kubkon@jakubkonka.com>", "Alex Crichton <alex@alexcrichton.com>"]
 license = "Apache-2.0 WITH LLVM-exception"
 edition = "2018"
diff --git a/crates/wiggle/macro/Cargo.toml b/crates/wiggle/macro/Cargo.toml
index 46fb57bd2d..01ba9648dd 100644
--- a/crates/wiggle/macro/Cargo.toml
+++ b/crates/wiggle/macro/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "wiggle-macro"
-version = "0.35.0"
+version = "0.36.0"
 authors = ["Pat Hickey <phickey@fastly.com>", "Jakub Konka <kubkon@jakubkonka.com>", "Alex Crichton <alex@alexcrichton.com>"]
 edition = "2018"
 license = "Apache-2.0 WITH LLVM-exception"
@@ -21,7 +21,7 @@ test = false
 doctest = false
 
 [dependencies]
-wiggle-generate = { path = "../generate", version = "=0.35.0" }
+wiggle-generate = { path = "../generate", version = "=0.36.0" }
 quote = "1.0"
 syn = { version = "1.0", features = ["full"] }
 proc-macro2 = "1.0"
diff --git a/docs/contributing-release-process.md b/docs/contributing-release-process.md
index 7f3cbed6a9..dbe3e1c0f5 100644
--- a/docs/contributing-release-process.md
+++ b/docs/contributing-release-process.md
@@ -7,61 +7,156 @@ others might be curious in this as well!
 ## Releasing a major version
 
 Major versions of Wasmtime are relased once-a-month. Most of this is automatic
-and **all that needs to be done is to merge the GitHub PR that CI will
-generate** on the second Monday of each month.
+and all that needs to be done is to merge GitHub PRs that CI will
+generate. At a high-level the structure of Wasmtime's release process is:
 
-Specifically what happens for a major version release is:
+* On the 5th of every month a new `release-X.Y.Z` branch is created with the
+  current contents of `main`.
+* On the 20th of every month this release branch is published to crates.io and
+  release artifacts are built.
 
-1. One day a month (configured via `.github/workflows/bump-version.yml`) a CI job
-   will run. This CI job will:
+This means that Wasmtime release are always at least two weeks behind
+development on `main` and additionally happen once a month. The lag time behind
+`main` is intended to give time to fuzz changes on `main` as well as allow
+testing for any users using `main`. It's expected, though, that most consumers
+will likely use the release branches of wasmtime.
+
+A detailed list of all the steps in the release automation process are below.
+The steps requiring interactions are **bolded**, otherwise everything else is
+automatic and this is documenting what automation does.
+
+1. On the 5th of every month, (configured via
+   `.github/workflows/release-process.yml`) a CI job
+   will run and do these steps:
   * Download the current `main` branch
+  * Push the `main` branch to `release-X.Y.Z`
   * Run `./scripts/publish.rs` with the `bump` argument
-  * Commit the changes with a special marker in the commit message
-  * Push these changes to a branch
+  * Commit the changes
+  * Push these changes to a temporary `ci/*` branch
   * Open a PR with this branch against `main`
-2. A maintainer of Wasmtime signs off on the PR and merges it.
-  * Most likely someone will need to push updates to `RELEASES.md` beforehand.
-  * A maintainer should double-check there are [no open security issues][rustsec-issues].
-3. The `.github/workflow/push-tag.yml` workflow is triggered on all commits to
-   `main`, including the one just created with a PR merge. This workflow will:
+  * This step can also be [triggered manually][ci-trigger] with the `main`
+    branch and the `cut` argument.
+2. **A maintainer of Wasmtime merges this PR**
+  * It's intended that this PR can be immediately merged as the release branch
+    has been created and all it's doing is bumping the version.
+3. **Time passes and the `release-X.Y.Z` branch is maintained**
+  * All changes land on `main` first, then are backported to `release-X.Y.Z` as
+    necessary.
+  * Even changes to `RELEASES.md` are pushed to `main` first.
+4. On the 20th of every month (same CI job as before) another CI job will run
+   performing:
+  * Download the current `main` branch.
+  * Update the release date of `X.Y.Z` to today in `RELEASES.md`
+  * Open a PR against `main` for this change
+  * Reset to `release-X.Y.Z`
+  * Update the release date of `X.Y.Z` to today in `RELEASES.md`
+  * Add a special marker to the commit message to indicate a tag should be made.
+  * Open a PR against `release-X.Y.Z` for this change
+  * This step can also be [triggered manually][ci-trigger] with the `main`
+    branch and the `release-latest` argument.
+5. **A maintainer of Wasmtime merges these two PRs**
+  * The PR against `main` is a small update to the release notes and should be
+    mergeable immediately.
+  * The PR against `release-X.Y.Z`, when merged, will trigger the next steps due
+    to the marker in the commit message. A maintainer should double-check there
+    are [no open security issues][rustsec-issues], but otherwise it's expected
+    that all other release issues are resolved by this point.
+6. The `.github/workflow/push-tag.yml` workflow is triggered on all commits
+   including the one just created with a PR merge. This workflow will:
    * Scan the git logs of pushed changes for the special marker added by
-     `bump-version.yml`.
+     `release-process.yml`.
    * If found, tags the current `main` commit and pushes that to the main
      repository.
-4. Once a tag is created CI runs in full on the tag itself. CI for tags will
+7. Once a tag is created CI runs in full on the tag itself. CI for tags will
    create a GitHub release with release artifacts and it will also publish
    crates to crates.io. This is orchestrated by `.github/workflows/main.yml`.
 
 If all goes well you won't have to read up much on this and after hitting the
-Big Green Button for the automatically created PR everything will merrily carry
-on its way.
+Big Green Button for the automatically created PRs everything will merrily
+carry on its way.
 
 [rustsec-issues]: https://github.com/bytecodealliance/wasmtime/issues?q=RUSTSEC+is%3Aissue+is%3Aopen+
+[ci-trigger]: https://github.com/bytecodealliance/wasmtime/actions/workflows/release-process.yml
 
-## Releasing a patch release
+## Releasing a patch version
 
-Making a patch release is somewhat more manual than a major version. At this
-time the process for making a patch release of `2.0.1` the process is:
+Making a patch release is somewhat more manual than a major version, but like
+before there's automation to help guide the process as well and take care of
+more mundane bits.
 
-1. All patch release development should be happening on a branch
-   `release-2.0.1`.
-  * Maintainers need to double-check that the `PUBLIC_CRATES` listed in
-    `scripts/publish.rs` do not have semver-API-breaking changes (in the
-    strictest sense). All security fixes must be done in such a way that the API
-    doesn't break between the patch version and the original version.
-2. Visit [this patch][bump-version] and manually trigger the `bump-version.yml`
-   workflow for the `release-2.0.1` branch with the `bump-patch` argument. This
-   will simulate step (1) of the above release process.
-3. Review the generated PR, probably updating `RLEASES.md` as well.
-  * Note that if historical branches may need updates to source code or CI to
-    pass itself since the CI likely hasn't been run in a month or so. When in
-    doubt don't be afraid to pin the Rust version in use to the rustc version
-    that was stable at the time of the branch's release.
-4. Merge the generated PR, and that's the whole patch release.
+This is a list of steps taken to perform a patch release for 2.0.1 for example.
+Like above human interaction is indicated with **bold** text in these steps.
 
-From this point automated processes should take care of the rest of the steps,
-basically resuming from step 3 above for major releases where `push-tag.yml`
-will recognize the commit message and push an appropriate tag. This new tag will
-then trigger full CI and building of release artifacts.
+1. **Necessary changes are backported to the `release-2.0.0` branch from
+   `main`**
+  * All changes must land on `main` first (if applicable) and then get
+    backported to an older branch. Release branches should already exist from
+    the above major release steps.
+  * CI may not have been run in some time for release branches so it may be
+    necessary to backport CI fixes and updates from `main` as well.
+  * When merging backports maintainers need to double-check that the
+    `PUBLIC_CRATES` listed in `scripts/publish.rs` do not have
+    semver-API-breaking changes (in the strictest sense). All security fixes
+    must be done in such a way that the API doesn't break between the patch
+    version and the original version.
+  * Don't forget to write patch notes in `RELEASES.md` for backported changes.
+2. **The patch release process is [triggered manually][ci-trigger] with
+   the `release-2.0.0` branch and the `release-patch` argument**
+  * This will run the `release-process.yml` workflow. The `scripts/publish.rs`
+    script will be run with the `bump-patch` argument.
+  * The changes will be committed with a special marker indicating a release
+    needs to be made.
+  * A PR will be created from a temporary `ci/*` branch to the `release-2.0.0`
+    branch which, when merged, will trigger the release process.
+3. **Review the generated PR and merge it**
+  * This will resume from step 6 above in the major release process where the
+    special marker in the commit message generated by CI will trigger a tag to
+    get pushed which will further trigger the rest of the release process.
+
+After a patch release has been made you'll also want to double-check that the
+release notes on the patch branch are in sync with the `main` branch.
 
 [bump-version]: https://github.com/bytecodealliance/wasmtime/actions/workflows/bump-version.yml
+
+## Releasing a security patch
+
+When making a patch release that has a security-related fix the contents of the
+patch are often kept private until the day of the patch release which means that
+the process here is slightly different from the patch release process above. In
+addition the precise [runbook is currently under discussion in an
+RFC](https://github.com/bytecodealliance/rfcs/pull/20) for security patches, so
+this intends to document what we've been doing so far and it'll get updated when
+the runbook is merged.
+
+1. **The fix for the security issue is developed in a GitHub Security
+   Advisory**
+  * This will not have any CI run, it's recommended to run `./ci/run-tests.sh`
+    locally at least.
+  * This will also only be the patch for the `main` branch. You'll need to
+    locally maintain and develop patches for any older releases being backported
+    to. Note that from the major release process there should already be a
+    branch for all older releases.
+2. **Send a PR for the version bump when an email goes out announcing there will
+   be a security release**
+  * An email is sent to the bytecodealliance security mailing list ahead of a
+    patch release to announce that a patch release will happen. At this time you
+    should [trigger the version bump][ci-trigger] against the appropriate
+    `release-x.y.z` branch with the `release-patch` argument.
+  * This will send a PR, but you should not merge it. Instead use this PR and
+    the time ahead of the security release to fix any issues with CI. Older
+    `release-x.y.z` branches haven't run CI in awhile so they may need to
+    backport fixes of one variety or another. DO NOT include the actual fix for
+    the security issue into the PR, that comes in the next step.
+3. **Make the patches public**
+  * For the `main` branch this will involve simply publishing the GitHub
+    Security Advisory. Note that CI will run after the advisory's changes are
+    merged in on `main`.
+  * For the backported release branches you should either create a PR targeting
+    these branches or push the changes to the previous version-bump PRs.
+3. **Merge the version-bump PR**
+  * Like the patch release process this will kick everything else into motion.
+    Note that the actual security fixes should be merged either before or as
+    part of this PR.
+
+After a security release has been made you'll also want to double-check that
+the release notes on the branch are in sync with the `main` branch.