diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf796019..534bd30a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -187,3 +187,24 @@ jobs:
             --generate-notes \
             --latest=${{ steps.version.outputs.is_latest }} \
             func-operator.yaml
+
+      # api/ is a separate Go module, versioned by tags with an api/ prefix.
+      # Tag it on the same commit with every release, so other projects (e.g. knative/func)
+      # can use the CRD types that match this operator version.
+      - name: Tag api module
+        run: |
+          TAG="api/v${{ steps.version.outputs.full }}"
+
+          # Release branches before release-0.4 have no api module
+          if [ ! -f api/go.mod ]; then
+            echo "No api module at this commit, skipping"
+            exit 0
+          fi
+
+          if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
+            echo "Tag $TAG already exists, skipping"
+            exit 0
+          fi
+
+          git tag "$TAG"
+          git push origin "$TAG"
diff --git a/docs/release.md b/docs/release.md
index 890cb0f2..68409688 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -43,6 +43,12 @@ For each tag, the `release` workflow:
 
 4. **Creates a GitHub release** with auto-generated release notes and the install manifest attached
 
+5. **Tags the `api` Go module** with `api/v{VERSION}` on the same commit, so other projects (e.g. knative/func) can import the CRD types that match this release:
+   ```bash
+   go get github.com/functions-dev/func-operator/api@v{VERSION}
+   ```
+   The tag is created for every release, even when `api/` did not change. It is skipped when the commit has no api module (release branches before `release-0.4`).
+
 ## Nightly Builds
 
 The `nightly-build` workflow runs daily at 00:00 UTC and pushes images from `main` tagged as `:main`.