diff --git a/.bcr/config.yml b/.bcr/config.yml
new file mode 100644
index 000000000..538fd4d8a
--- /dev/null
+++ b/.bcr/config.yml
@@ -0,0 +1,2 @@
+moduleRoots:
+  - "core"
diff --git a/.bcr/core/metadata.template.json b/.bcr/core/metadata.template.json
new file mode 100644
index 000000000..71b673c26
--- /dev/null
+++ b/.bcr/core/metadata.template.json
@@ -0,0 +1,20 @@
+{
+  "homepage": "https://nix-bazel.build",
+  "maintainers": [
+    {
+      "email": "benjamin.radford@tweag.io ",
+      "github": "benradf",
+      "name": "Benjamin Radford"
+    },
+    {
+      "email": "andreas.herrmann@tweag.io",
+      "github": "aherrmann",
+      "name": "Andreas Herrmann"
+    }
+  ],
+  "repository": [
+    "github:tweag/rules_nixpkgs"
+  ],
+  "versions": [],
+  "yanked_versions": []
+}
diff --git a/.bcr/core/presubmit.yml b/.bcr/core/presubmit.yml
new file mode 100644
index 000000000..14fcfd0f2
--- /dev/null
+++ b/.bcr/core/presubmit.yml
@@ -0,0 +1,15 @@
+bcr_test_module:
+  module_path: "testing"
+  matrix:
+    platform: ["ubuntu2204"]
+  tasks:
+    run_tests:
+      name: "Run test module"
+      platform: ${{ platform }}
+      shell_commands:
+        - apt update
+        - apt install --yes nix-setup-systemd
+        - nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgs
+        - nix-channel --update
+      test_targets:
+        - "//..."
diff --git a/.bcr/core/source.template.json b/.bcr/core/source.template.json
new file mode 100644
index 000000000..4a099d2d3
--- /dev/null
+++ b/.bcr/core/source.template.json
@@ -0,0 +1,5 @@
+{
+  "integrity": "",
+  "strip_prefix": "{REPO}-{VERSION}/core",
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/${REPO}-${VERSION}.tar.gz"
+}
diff --git a/.github/build-and-test b/.github/build-and-test
index ff4feacf0..14d8a9291 100755
--- a/.github/build-and-test
+++ b/.github/build-and-test
@@ -35,6 +35,7 @@ if [[ ${BZLMOD_ENABLED-} = true ]]; then
         toolchains/python
     )
     declare -ra test_dirs=(
+        core/testing
         testing/core
         testing/core/tests/intermediate_module
         testing/go-bzlmod
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 000000000..bd7019452
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,46 @@
+# Cut a release whenever a new tag is pushed to the repo.
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  tests:
+    # Do only release when CI succeeds.
+    uses: ./.github/workflows/workflow.yaml
+
+  release:
+    # Do only release when CI succeeds.
+    needs: [tests]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Get version number
+        id: get-version
+        run: set -x; echo "version=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
+      - name: Read section from CHANGELOG.md
+        id: extract-changelog
+        uses: sean0x42/markdown-extract@v2
+        with:
+         file: CHANGELOG.md
+         pattern: ${{ steps.get-version.outputs.version }}
+      - name: Prepare release notes and artifacts
+        run: |
+          .github/workflows/release_prep.sh ${{ env.GITHUB_REF_NAME }} > release_notes.txt
+          printf '${{ steps.extract-changelog.outputs.markdown }}' >> release_notes.txt
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        with:
+          draft: true
+          prerelease: true
+          # Use GH feature to populate the changelog automatically
+          generate_release_notes: true
+          body_path: release_notes.txt
+          fail_on_unmatched_files: true
+          files: rules_nixpkgs*-*.tar.gz
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
new file mode 100755
index 000000000..c79777282
--- /dev/null
+++ b/.github/workflows/release_prep.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Set by GH actions, see
+# https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+TAG=${GITHUB_REF_NAME}
+# The prefix is chosen to match what GitHub generates for source archives
+PREFIX="rules_nixpkgs-${TAG:1}"
+ARCHIVE="rules_nixpkgs-${TAG:1}.tar.gz"
+git archive --format=tar.gz --prefix="${PREFIX}/" -o $ARCHIVE ${TAG}
+SHA=$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')
+
+cat << EOF
+## Using Bzlmod with Bazel 6
+
+1. Enable with \`common --enable_bzlmod\` in \`.bazelrc\`.
+2. Add to your \`MODULE.bazel\` file:
+
+\`\`\`starlark
+bazel_dep(name = "rules_nixpkgs_core", version = "${TAG:1}")
+\`\`\`
+
+## Using WORKSPACE
+
+Paste this snippet into your \`WORKSPACE.bazel\` file:
+
+\`\`\`starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "io_tweag_rules_nixpkgs",
+    sha256 = "${SHA}",
+    strip_prefix = "$PREFIX",
+    urls = ["https://github.com/tweag/rules_nixpkgs/releases/download/$TAG/$ARCHIVE"],
+)
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:repositories.bzl", "rules_nixpkgs_dependencies")
+
+rules_nixpkgs_dependencies()
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_git_repository", "nixpkgs_package", "nixpkgs_cc_configure")
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:toolchains/go.bzl", "nixpkgs_go_configure") # optional
+\`\`\`
+EOF
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index b301b4352..001bec59d 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -6,6 +6,7 @@ on:
   pull_request:
     branches: master
   workflow_dispatch: # allows manual triggering
+  workflow_call: # allows call from another workflow
 
 jobs:
   cancel-running-workflows:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b194c5f85..6f44e76d4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,14 +6,69 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ## [Unreleased]
 
-[Unreleased]: https://github.com/tweag/rules_nixpkgs/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/tweag/rules_nixpkgs/compare/v0.10.0...HEAD
+
+## [0.10.0] - 2023-10-18
+
+[0.10.0]: https://github.com/tweag/rules_nixpkgs/compare/v0.9.0...v0.10.0
 
 ### Added
-- nixpkgs_nodejs_configure_platforms for platform transparent npm_install
-  See [#309]
+- nixpkgs_nodejs_configure to import a NodeJS toolchain. See [#222].
+- nixpkgs_nodejs_configure_platforms for platform transparent npm_install. See [#309].
+- nixkpgs_python_configure generates an interpreter target. See [#255].
+- nixpkgs_go_configure gained an attribute_path attribute. See [#288].
+- nixpkgs_cc_configure gained the ability to configure CXX_FLAGS. See [#298].
+- nixpkgs_local_repository now accepts a flake.lock file to generate a nixpkgs repository. See [#338].
+- nixpkgs_python_repository can import Nix provided Python packages, e.g. through poetry. See [#343].
+- nixpkgs_http_repository can download a nixpkgs repository over HTTP. See [#356].
+- nixpkgs_flake_package can add a Nix package from a flake. See [#380].
+- rules_nixpkgs gained the ability to copy generated Nix store paths to a remote store for remote execution support. See [#404].
+- rules_nixpkgs_core gained bzlmod module extensions nix_repo and nix_pkg to import nixpkgs repositories and packages in MODULE.bazel files directly. See [#423].
+
+[#222]: https://github.com/tweag/rules_nixpkgs/pull/222
+[#255]: https://github.com/tweag/rules_nixpkgs/issues/255
+[#288]: https://github.com/tweag/rules_nixpkgs/pull/288
+[#298]: https://github.com/tweag/rules_nixpkgs/pull/298
+[#338]: https://github.com/tweag/rules_nixpkgs/pull/338
+[#343]: https://github.com/tweag/rules_nixpkgs/pull/343
+[#356]: https://github.com/tweag/rules_nixpkgs/pull/356
+[#380]: https://github.com/tweag/rules_nixpkgs/pull/380
+[#404]: https://github.com/tweag/rules_nixpkgs/pull/404
+[#423]: https://github.com/tweag/rules_nixpkgs/pull/423
+
+### Changed
+- nixpkgs_cc_configure now supports cross compilation toolchains. See [#241] and [#401].
+- rules_nixpkgs_dependencies takes a toolchains parameter to specify which rules_nixpkgs components to imoprt. See [#257]
+- nixpkgs_cc_configure now works without an explicit nix_file or nix_file_content attribute. See [#334].
+- nixpkgs_python_configure now exposes the requirements.json file. See [#407].
+
+[#241]: https://github.com/tweag/rules_nixpkgs/pull/241
+[#257]: https://github.com/tweag/rules_nixpkgs/pull/257
+[#334]: https://github.com/tweag/rules_nixpkgs/pull/334
+[#401]: https://github.com/tweag/rules_nixpkgs/pull/401
+[#407]: https://github.com/tweag/rules_nixpkgs/pull/407
+
+### Fixed
+- A performance issue with nixpkgs_package on MacOS due to slow file copies was resolved. See [#256].
+- A performance issue with nixpkgs_package due to repeated rule restarts was resolved. See [#263].
+- Compatibility issues with Bazel 6 for nixpkgs_configure_java were resolved. See [#273].
+- C++ build errors on MacOS due to -Welaborated-enum-base were fixed. See [#382].
+- Hard to read error reporting was improved. See [#389].
+- The http_archive type attribute is now forwarded to rules_nixpkgs component imports. See [#411].
+- Configuration issues when cross-compiling from Linux to MacOS were fixed. See [#413].
+
+[#256]: https://github.com/tweag/rules_nixpkgs/issues/256
+[#263]: https://github.com/tweag/rules_nixpkgs/pull/263
+[#273]: https://github.com/tweag/rules_nixpkgs/pull/273
+[#382]: https://github.com/tweag/rules_nixpkgs/pull/382
+[#389]: https://github.com/tweag/rules_nixpkgs/pull/389
+[#411]: https://github.com/tweag/rules_nixpkgs/pull/411
+[#413]: https://github.com/tweag/rules_nixpkgs/pull/413
   
 ### Breaking changes
-- rules_nixpkgs_go: Custom derivations passed to `nixpkgs_go_configure` (via `nix-file`, `nix-file-content` or `attribute_path`) must now contain a `version` attribute.
+- rules_nixpkgs_go: Custom derivations passed to `nixpkgs_go_configure` (via `nix-file`, `nix-file-content` or `attribute_path`) must now contain a `version` attribute. See [#385].
+
+[#385]: https://github.com/tweag/rules_nixpkgs/pull/385
 
 ## [0.9.0] - 2022-07-19
 
diff --git a/core/.bazelignore b/core/.bazelignore
index ac51a054d..a61f183f2 100644
--- a/core/.bazelignore
+++ b/core/.bazelignore
@@ -1 +1,2 @@
 bazel-*
+testing
diff --git a/core/MODULE.bazel b/core/MODULE.bazel
index feec49cc5..52953eca1 100644
--- a/core/MODULE.bazel
+++ b/core/MODULE.bazel
@@ -1,6 +1,6 @@
 module(
     name = "rules_nixpkgs_core",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
 bazel_dep(name = "platforms", version = "0.0.4")
diff --git a/core/testing/.bazelrc b/core/testing/.bazelrc
new file mode 100644
index 000000000..766b1c3ef
--- /dev/null
+++ b/core/testing/.bazelrc
@@ -0,0 +1,12 @@
+# Note, this file cannot load the .bazelrc file in rules_nixpkgs, because it
+# needs to work from an extraction of rules_nixpkgs_core only.
+
+build --host_platform=@rules_nixpkgs_core//platforms:host
+
+common:bzlmod --enable_bzlmod
+
+# User Configuration
+# ------------------
+try-import %workspace%/.bazelrc.local
+
+# vim: ft=conf
diff --git a/core/testing/BUILD.bazel b/core/testing/BUILD.bazel
new file mode 100644
index 000000000..b5cb113ba
--- /dev/null
+++ b/core/testing/BUILD.bazel
@@ -0,0 +1,14 @@
+load("@bazel_skylib//rules:diff_test.bzl", "diff_test")
+
+genrule(
+    name = "hello.actual",
+    cmd = "$(execpath @hello//:bin/hello) > $(OUTS)",
+    tools = ["@hello//:bin/hello"],
+    outs = ["hello.actual.txt"],
+)
+
+diff_test(
+    name = "test",
+    file1 = ":hello.actual.txt",
+    file2 = ":hello.expected.txt",
+)
diff --git a/core/testing/MODULE.bazel b/core/testing/MODULE.bazel
new file mode 100644
index 000000000..0cbb3a1dc
--- /dev/null
+++ b/core/testing/MODULE.bazel
@@ -0,0 +1,13 @@
+module(name = "rules_nixpkgs_core_bcr_testing")
+
+bazel_dep(name = "rules_nixpkgs_core")
+local_path_override(
+    module_name = "rules_nixpkgs_core",
+    path = "..",
+)
+
+nix_pkg = use_extension("@rules_nixpkgs_core//extensions:package.bzl", "nix_pkg")
+nix_pkg.default(attr = "hello")
+use_repo(nix_pkg, "hello")
+
+bazel_dep(name = "bazel_skylib", version = "1.4.2")
diff --git a/core/testing/README.md b/core/testing/README.md
new file mode 100644
index 000000000..e2a8a69d8
--- /dev/null
+++ b/core/testing/README.md
@@ -0,0 +1,6 @@
+This is a minimal test module for rules_nixpkgs_core intended for [Bazel CI
+testing][bcr-test-module] on the Bazel Central Registry.
+
+More in-depth testing is performed in rules_nixpkgs/testing/core.
+
+[bcr-test-module]: https://github.com/bazelbuild/bazel-central-registry/blob/main/docs/README.md#test-module
diff --git a/core/testing/WORKSPACE b/core/testing/WORKSPACE
new file mode 100644
index 000000000..e69de29bb
diff --git a/core/testing/hello.expected.txt b/core/testing/hello.expected.txt
new file mode 100644
index 000000000..af5626b4a
--- /dev/null
+++ b/core/testing/hello.expected.txt
@@ -0,0 +1 @@
+Hello, world!
diff --git a/docs/MODULE.bazel b/docs/MODULE.bazel
index 29702bc49..b61e2d538 100644
--- a/docs/MODULE.bazel
+++ b/docs/MODULE.bazel
@@ -1,6 +1,6 @@
 module(
     name = "rules_nixpkgs_docs",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
 bazel_dep(name = "rules_sh", version = "0.3.0")
diff --git a/registry/modules/rules_nixpkgs_core/0.9.0/MODULE.bazel b/registry/modules/rules_nixpkgs_core/0.10.0/MODULE.bazel
similarity index 100%
rename from registry/modules/rules_nixpkgs_core/0.9.0/MODULE.bazel
rename to registry/modules/rules_nixpkgs_core/0.10.0/MODULE.bazel
diff --git a/registry/modules/rules_nixpkgs_core/0.9.0/source.json b/registry/modules/rules_nixpkgs_core/0.10.0/source.json
similarity index 100%
rename from registry/modules/rules_nixpkgs_core/0.9.0/source.json
rename to registry/modules/rules_nixpkgs_core/0.10.0/source.json
diff --git a/registry/modules/rules_nixpkgs_core/metadata.json b/registry/modules/rules_nixpkgs_core/metadata.json
index 92a394339..8f997ed81 100644
--- a/registry/modules/rules_nixpkgs_core/metadata.json
+++ b/registry/modules/rules_nixpkgs_core/metadata.json
@@ -12,6 +12,6 @@
       "name": "Andreas Herrmann"
     }
   ],
-  "versions": ["0.9.0"],
+  "versions": ["0.10.0"],
   "yanked_versions": []
 }
diff --git a/toolchains/cc/MODULE.bazel b/toolchains/cc/MODULE.bazel
index 28c3bd634..75505dbb9 100644
--- a/toolchains/cc/MODULE.bazel
+++ b/toolchains/cc/MODULE.bazel
@@ -1,8 +1,8 @@
 module(
     name = "rules_nixpkgs_cc",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
-bazel_dep(name = "rules_nixpkgs_core", version = "0.9.0")
+bazel_dep(name = "rules_nixpkgs_core", version = "0.10.0")
 bazel_dep(name = "bazel_skylib", version = "1.0.3")
 bazel_dep(name = "rules_cc", version = "0.0.1")
diff --git a/toolchains/go/MODULE.bazel b/toolchains/go/MODULE.bazel
index c021a884e..c79b46e09 100644
--- a/toolchains/go/MODULE.bazel
+++ b/toolchains/go/MODULE.bazel
@@ -1,9 +1,9 @@
 module(
     name = "rules_nixpkgs_go",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
-bazel_dep(name = "rules_nixpkgs_core", version = "0.9.0")
+bazel_dep(name = "rules_nixpkgs_core", version = "0.10.0")
 bazel_dep(name = "rules_go", repo_name = "io_bazel_rules_go", version = "0.39.1")
 bazel_dep(name = "bazel_skylib", version = "1.0.3")
 bazel_dep(name = "platforms", version = "0.0.4")
diff --git a/toolchains/java/MODULE.bazel b/toolchains/java/MODULE.bazel
index 008d8f603..77a54f3e7 100644
--- a/toolchains/java/MODULE.bazel
+++ b/toolchains/java/MODULE.bazel
@@ -1,8 +1,8 @@
 module(
     name = "rules_nixpkgs_java",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
-bazel_dep(name = "rules_nixpkgs_core", version = "0.9.0")
+bazel_dep(name = "rules_nixpkgs_core", version = "0.10.0")
 bazel_dep(name = "rules_java", version = "4.0.0")
 bazel_dep(name = "bazel_skylib", version = "1.0.3")
diff --git a/toolchains/nodejs/MODULE.bazel b/toolchains/nodejs/MODULE.bazel
index 1c317aadd..b0d67c626 100644
--- a/toolchains/nodejs/MODULE.bazel
+++ b/toolchains/nodejs/MODULE.bazel
@@ -1,8 +1,8 @@
 module(
     name = "rules_nixpkgs_nodejs",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
-bazel_dep(name = "rules_nixpkgs_core", version = "0.9.0")
+bazel_dep(name = "rules_nixpkgs_core", version = "0.10.0")
 bazel_dep(name = "rules_nodejs", version = "5.5.3")
 bazel_dep(name = "bazel_skylib", version = "1.0.3")
diff --git a/toolchains/posix/MODULE.bazel b/toolchains/posix/MODULE.bazel
index 0048bef23..2fedb1687 100644
--- a/toolchains/posix/MODULE.bazel
+++ b/toolchains/posix/MODULE.bazel
@@ -1,8 +1,8 @@
 module(
     name = "rules_nixpkgs_posix",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
-bazel_dep(name = "rules_nixpkgs_core", version = "0.9.0")
+bazel_dep(name = "rules_nixpkgs_core", version = "0.10.0")
 bazel_dep(name = "rules_sh", version = "0.3.0")
 bazel_dep(name = "bazel_skylib", version = "1.0.3")
diff --git a/toolchains/python/MODULE.bazel b/toolchains/python/MODULE.bazel
index 1fe15b52c..4b59c3622 100644
--- a/toolchains/python/MODULE.bazel
+++ b/toolchains/python/MODULE.bazel
@@ -1,7 +1,7 @@
 module(
     name = "rules_nixpkgs_python",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
-bazel_dep(name = "rules_nixpkgs_core", version = "0.9.0")
+bazel_dep(name = "rules_nixpkgs_core", version = "0.10.0")
 bazel_dep(name = "bazel_skylib", version = "1.0.3")
diff --git a/toolchains/rust/MODULE.bazel b/toolchains/rust/MODULE.bazel
index 7546c3633..8dcfac711 100644
--- a/toolchains/rust/MODULE.bazel
+++ b/toolchains/rust/MODULE.bazel
@@ -1,9 +1,9 @@
 module(
     name = "rules_nixpkgs_rust",
-    version = "0.9.0",
+    version = "0.10.0",
 )
 
-bazel_dep(name = "rules_nixpkgs_core", version = "0.9.0")
+bazel_dep(name = "rules_nixpkgs_core", version = "0.10.0")
 bazel_dep(name = "bazel_skylib", version = "1.0.3")
 # TODO: there is no BCR entry for `rules_rust` yet, and you will have to add a
 # local registry entry to map a commit to a module "version". the caller will