diff --git a/.github/workflows/checks.sh b/.github/workflows/checks.sh
index 0696c548..b1845e32 100755
--- a/.github/workflows/checks.sh
+++ b/.github/workflows/checks.sh
@@ -2,6 +2,10 @@
 
 set -o errexit -o nounset -o pipefail
 
+# First, check the core providers basically OK.
+bazel_cmd=(bazel query :all)
+echo "${bazel_cmd[@]}"
+( cd providers ; "${bazel_cmd[@]}" )
 
 FILTERS=()
 if [[ -n "${TEST_FILTER:-}" ]] ; then
@@ -14,18 +18,9 @@ bazel_cmd=(bazel test --build_tests_only "${FILTERS[@]}" -- ${TESTS} //examples/
 
 echo "${bazel_cmd[@]}"
 "${bazel_cmd[@]}"
-exit_code="$?"
-if [ "${exit_code}" -ne 0 ] ; then
-    exit "${exit_code}"
-fi
 
 if [ -n "${BUILD_DISTRO:-}" ] ; then
     bazel build  //distro:distro
-    exit_code="$?"
-    if [ "${exit_code}" -ne 0 ] ; then
-        echo "Could not build //distro:distro"
-        exit "${exit_code}"
-    fi
 fi
 
 exit "${exit_code}"
diff --git a/.github/workflows/release_module.yml b/.github/workflows/release_module.yml
new file mode 100644
index 00000000..99a9c0f7
--- /dev/null
+++ b/.github/workflows/release_module.yml
@@ -0,0 +1,69 @@
+name: "Create a submodule release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      subdir:
+        required: true
+        type: string
+        description: "The subdir within rules_pkg"
+        default: "providers"
+      version:
+        required: true
+        type: string
+        description: "Version #"
+
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+
+jobs:
+  tests:
+    name: "Release Tests"
+    uses: "./.github/workflows/checks.yml"
+
+  create_tag:
+    name: "Create tag"
+    runs-on:
+      - "ubuntu-latest"
+    needs:
+      - "tests"
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: "Create tag"
+        id: "tag"
+        env:
+          SUBDIR: "${{ inputs.subdir }}"
+          VERSION: "${{ inputs.version }}"
+          MODULE: "rules_pkg_${SUBDIR}"
+
+          GIT_AUTHOR_NAME: "${{ github.actor }}"
+          GIT_AUTHOR_EMAIL: "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+          GIT_COMMITTER_NAME: "${{ github.actor }}"
+          GIT_COMMITTER_EMAIL: "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+        run: |
+          # Download `buildozer`
+          #
+          curl -o "${RUNNER_TEMP}/buildozer" -L "https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildozer-linux-amd64"
+          "${RUNNER_TEMP}/buildozer" "set version ${VERSION}" "//${SUBDIR}/MODULE.bazel:${MODULE}" || true
+          git add "${MODULE}/MODULE.bazel"
+          git commit -m "Release `${MODULE}-${VERSION}`"
+
+          # 3. Push release tag.
+          git tag "${MODULE}-${VERSION}" "HEAD"
+          git push origin "${MODULE}-${VERSION}"
+
+  release:
+    name: "Create GitHub release"
+    needs:
+      - "create_tag"
+
+    uses: "bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.4"
+    with:
+      # This will run release_prep.sh to do the dirty work.
+      # TODO: https://github.com/bazelbuild/rules_pkg/issues/1031
+      release_files: "bazel-bin/distro/rules_pkg_${{ inputs.subdir }}-*.tgz"
+      tag_name: "rule_pkg_${{ inputs.subdir }}-${{ inputs.version }}"
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
index 98e44933..0aa194d1 100755
--- a/.github/workflows/release_prep.sh
+++ b/.github/workflows/release_prep.sh
@@ -5,11 +5,32 @@ set -o errexit -o nounset -o pipefail
 # Passed as argument when invoking the script.
 TAG="${1}"
 
-# The prefix is chosen to match what GitHub generates for source archives
-# This guarantees that users can easily switch from a released artifact to a source archive
-# with minimal differences in their code (e.g. strip_prefix remains the same)
-PREFIX="rules_pkg--${TAG:1}"
-ARCHIVE="rules_pkg-$TAG.tar.gz"
-
-bazel build distro:relnotes
-cat bazel-bin/distro/relnotes.txt
+# Get back to the root
+cd ../../
+
+case "${TAG}" in
+  [0-9]* )
+    # This is the rules_pkg main release.
+    VERSION="${TAG:1}"
+    PREFIX="rules_pkg-${TAG:1}"
+    ARCHIVE="rules_pkg-$TAG.tar.gz"
+
+    bazel build //distro:relnotes
+    cat bazel-bin/distro/relnotes.txt
+    exit 0
+    ;;
+  * )
+    ;;
+esac
+
+# If we fall to here, we are in a sub-module release
+
+# TODO: We could pass the version as a build time flag. I don't want
+# to do that yet, because I want to discuss this with other rule
+# authors.
+# VERSION=$(echo "$TAG" | sed -e 's/^.*-//')
+MODULE=$(echo "$TAG" | sed -e 's/-[0-9]*.*$//')
+
+bazel build //distro:${MODULE}_relnotes
+cp bazel-bin/distro/${MODULE}*tgz .
+cat bazel-bin/distro/${MODULE}_relnotes.txt
diff --git a/distro/BUILD b/distro/BUILD
index d105f560..dd431f42 100644
--- a/distro/BUILD
+++ b/distro/BUILD
@@ -14,9 +14,11 @@
 
 load("@rules_python//python:defs.bzl", "py_test")
 load("//:version.bzl", "version")
+load("//pkg:mappings.bzl", "pkg_files", "strip_prefix")
 load("//pkg:tar.bzl", "pkg_tar")
 load("//pkg/releasing:defs.bzl", "print_rel_notes")
 load("//pkg/releasing:git.bzl", "git_changelog")
+load("//providers:version.bzl", providers_version = "version")
 
 package(
     default_applicable_licenses = ["//:license"],
@@ -117,3 +119,37 @@ genrule(
     outs = ["release_version.py"],
     cmd = "echo RELEASE_VERSION = \\'%s\\' >$@" % version,
 )
+
+#
+# Submodules
+#
+pkg_files(
+    name = "rules_pkg_providers_files",
+    srcs = [
+        "//providers:all_srcs",
+    ],
+    strip_prefix = strip_prefix.from_root("providers"),
+)
+
+pkg_tar(
+    name = "rules_pkg_providers_tar",
+    srcs = [
+        ":rules_pkg_providers_files",
+    ],
+    out = "rules_pkg_providers-%s.tgz" % providers_version,
+    extension = "tgz",
+    # It is all source code, so make it read-only.
+    mode = "0444",
+    # Make it owned by root so it does not have the uid of the CI robot.
+    owner = "0.0",
+    package_dir = ".",
+)
+
+print_rel_notes(
+    name = "rules_pkg_providers_relnotes",
+    outs = ["rules_pkg_providers_relnotes.txt"],
+    artifact_name = "rules_pkg_providers-%s.tgz" % providers_version,
+    org = "bazelbuild",
+    repo = "rules_pkg_providers",
+    version = providers_version,
+)
diff --git a/providers/BUILD b/providers/BUILD
index 5a1a4887..b375a817 100644
--- a/providers/BUILD
+++ b/providers/BUILD
@@ -29,5 +29,9 @@ license(
 
 filegroup(
     name = "all_srcs",
-    srcs = glob(["**"]),
+    srcs = [
+        "BUILD",
+        "LICENSE",
+        "MODULE.bazel",
+    ] + glob(["**/*.bzl"]),
 )
diff --git a/providers/version.bzl b/providers/version.bzl
new file mode 100644
index 00000000..ead02a6e
--- /dev/null
+++ b/providers/version.bzl
@@ -0,0 +1,3 @@
+"""The version of rules_pkg_providers."""
+
+version = "1.0.0"