diff --git a/.github/workflows/check-new-tag.yml b/.github/workflows/check-new-tag.yml
new file mode 100644
index 0000000..924e467
--- /dev/null
+++ b/.github/workflows/check-new-tag.yml
@@ -0,0 +1,32 @@
+# check-new-tag.yml
+
+name: Check for new tags
+on:
+  push:
+    branches:
+      - master
+      - pre/*
+      - post/*
+
+jobs:
+  check-tag:
+    permissions:
+      contents: write
+
+    name: check for new tags
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: check for new version
+        id: check-tag
+        uses: biocatchltd/gh-actions-is-new-version@main
+
+      - name: release a new version
+        if: steps.check-tag.outputs.is-new == 'true'
+        uses: softprops/action-gh-release@v2
+        with:
+          body: ${{ steps.check-tag.outputs.release-notes }}
+          tag_name: ${{ steps.check-tag.outputs.found-version }}
+          target_commitish: ${{ github.sha }}
+          prerelease: ${{ steps.check-tag.outputs.is-prerelease }}
+          token: ${{ secrets.BC_AUTOMATIONS_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/label-bump-prs.yml b/.github/workflows/label-bump-prs.yml
new file mode 100644
index 0000000..a94cc65
--- /dev/null
+++ b/.github/workflows/label-bump-prs.yml
@@ -0,0 +1,48 @@
+# label-bump-prs.yml
+name: Handle VLock PRs
+
+on:
+  pull_request:
+    types: [opened, reopened, edited, synchronize]
+    branches:
+      - master
+
+jobs:
+  label-vlock-prs:
+    name: Handle Version Lock PRs
+    runs-on: ubuntu-latest
+    steps:
+      - name: check for new version
+        id: check-tag
+        uses: biocatchltd/gh-actions-is-new-version@main
+
+      - name: label prs
+        if: steps.check-tag.outputs.is-new == 'true'
+        uses: actions-ecosystem/action-add-labels@v1
+        with:
+            labels: version-lock
+
+      - name: check that vlock prs are good to release
+        if: steps.check-tag.outputs.is-new == 'true'
+        run: |
+            pip install --upgrade pip setuptools
+            pip install poetry==1.7.1
+            sh scripts/check-version.sh
+
+      - name: check no other version locks
+        id: check-vlock
+        if: steps.check-tag.outputs.is-new != 'true'
+        uses: juliangruber/find-pull-request-action@v1
+        with:
+            labels: version-lock
+            base: master
+
+      - name: block if vlock in progress
+        if: steps.check-tag.outputs.is-new != 'true'
+        uses: biocatchltd/gh-actions-block-with-comment@main
+        with:
+          fail-message: |
+            Version lock in progress. Please wait for it to close before merging (#${{steps.check-vlock.outputs.number}}).
+
+          comment_tag: version-lock
+          test: ${{steps.check-vlock.outputs.state != 'open'}}
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6561221..d2fd895 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,10 +36,8 @@ jobs:
         echo toml "$TOML_VER"
         GIT_VER=${{ github.event.release.tag_name }}
         echo git "$GIT_VER"
-        LIB_VER=$(python -c "exec(open('yellowbox/_version.py').read()); print(__version__)")
-        echo lib "$LIB_VER"
         [[ "$TOML_VER" == "$GIT_VER" ]]
-        [[ "$TOML_VER" == "$LIB_VER" ]]
+        echo "__version__ = \"$GIT_VER\"" > yellowbox/_version.py
     - name: Publish
       env:
         PYPI_USERNAME: ${{ secrets.pypi_user }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 69c2892..d598521 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # Yellowbox Changelog
-## NEXT
+## 0.8.8
 ### Changed
+* moved to trunk
 * connecting container to network now has a fallback if `Alias` field is empty to `DNSNames`
 ### Removed
 * dropped support for python 3.7
diff --git a/pyproject.toml b/pyproject.toml
index e809a34..9719745 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "yellowbox"
-version = "0.8.7"
+version = "0.8.8"
 description = ""
 authors = ["biocatch ltd"]
 license = "MIT"
diff --git a/scripts/check-version.sh b/scripts/check-version.sh
new file mode 100644
index 0000000..63b0047
--- /dev/null
+++ b/scripts/check-version.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+# checks that a version is ready to be released
+set -e
+
+if ls newsfragments/*.md 2> /dev/null; then
+    echo "Unbuilt newsfragments exist, exiting" && exit 1
+fi
+
+CL_VERSION=$(awk '/^## \[(.+)\]|[0-9.]+/ {print gensub(/(\[(.+)\]|([0-9.]+)).*$/, "\\2\\3", "g", $2); exit}' CHANGELOG.md)
+if [ -z "$CL_VERSION" ]; then
+    echo "Could not find version in CHANGELOG.md" && exit 1
+fi
+
+TOML_VERSION=$(poetry version | cut -d' ' -f2)
+
+if [ "$CL_VERSION" != "$TOML_VERSION" ]; then
+    echo "Version mismatch between CHANGELOG.md and pyproject.toml ($CL_VERSION vs $TOML_VERSION)" && exit 1
+fi
\ No newline at end of file
diff --git a/yellowbox/_version.py b/yellowbox/_version.py
index 686e10f..7602829 100644
--- a/yellowbox/_version.py
+++ b/yellowbox/_version.py
@@ -1 +1 @@
-__version__ = "0.8.7"
+__version__ = ""