diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a2ecb40..b0ad766 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,8 +1,13 @@
 name: CI
 
+permissions:
+  contents: read
+  packages: write
+
 on:
   push:
     branches: [ main, master ]
+    tags: ['v*']
   pull_request:
     branches: [ main, master ]
 
@@ -53,7 +58,7 @@ jobs:
   publish-nuget:
     runs-on: ubuntu-latest
     needs: pack-smoke
-    if: (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main') && github.event_name == 'push'
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -102,3 +107,13 @@ jobs:
             exit 1
           fi
           dotnet nuget push out/*.nupkg --api-key ${NUGET_API_KEY} --source https://api.nuget.org/v3/index.json --skip-duplicate
+
+      - name: Publish to GitHub Packages
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -z "${GITHUB_TOKEN}" ]; then
+            echo "Missing GITHUB_TOKEN; skipping GitHub Packages publish"
+            exit 1
+          fi
+          dotnet nuget push out/*.nupkg --api-key ${GITHUB_TOKEN} --source https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json --skip-duplicate