@@ -0,0 +1,132 @@
+name: nuget-e2e
+
+on:
+  push:
+    branches:
+      - copilot/create-nuget-credential-provider
+
+permissions:
+  contents: read
+
+jobs:
+  e2e:
+    name: ${{ matrix.os }} / ${{ matrix.case }} / ${{ matrix.mode }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-14, windows-2025]
+        case: [standard, custom]
+        mode: [source, frozen]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash
+    env:
+      RAW_API_HOST: ${{ vars.PYTEST_CLOUDSMITH_API_HOST }}
+      CLOUDSMITH_API_KEY: ${{ matrix.case == 'custom' && secrets.PYTEST_CLOUDSMITH_CUSTOM_DOMAIN_API_KEY || secrets.PYTEST_CLOUDSMITH_API_KEY }}
+      CLOUDSMITH_NO_KEYRING: "1"
+      WORKSPACE: ${{ matrix.case == 'custom' && vars.PYTEST_CLOUDSMITH_CUSTOM_DOMAIN_WORKSPACE || vars.PYTEST_CLOUDSMITH_ORGANIZATION }}
+      REPO: ${{ matrix.case == 'custom' && 'cli-pytest-custom-domain' || 'cli-pytest-nuget' }}
+      CASE: ${{ matrix.case }}
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Install the CLI from source
+        if: matrix.mode == 'source'
+        run: |
+          set -euo pipefail
+          uv sync --locked --no-dev --python 3.14
+          if [ "$RUNNER_OS" = Windows ]; then bin=Scripts; else bin=bin; fi
+          echo "$GITHUB_WORKSPACE/.venv/$bin" >> "$GITHUB_PATH"
+
+      - name: Build the frozen CLI
+        if: matrix.mode == 'frozen'
+        env:
+          PYINSTALLER_CONFIG_DIR: ${{ runner.temp }}/pyinstaller
+        run: |
+          set -euo pipefail
+          uv sync --locked --no-dev --no-editable --group binary --extra all --python 3.14
+          uv run --no-sync pyinstaller --clean --noconfirm packaging/pyinstaller/cloudsmith.spec
+          mv dist/cloudsmith "$RUNNER_TEMP/cloudsmith-frozen"
+          echo "$RUNNER_TEMP/cloudsmith-frozen" >> "$GITHUB_PATH"
+
+      - name: Find the feed
+        run: |
+          set -euo pipefail
+          export CLOUDSMITH_API_HOST="${RAW_API_HOST%/v1}"
+          echo "CLOUDSMITH_API_HOST=$CLOUDSMITH_API_HOST" >> "$GITHUB_ENV"
+          which cloudsmith
+          cloudsmith --version
+          cloudsmith domains list --workspace "$WORKSPACE" > domains.json
+          feed=$(python - <<'EOF'
+          import json, os
+          data = json.load(open("domains.json"))
+          data = data.get("data", data)
+          rows = [d for d in data["domains"] if d["format"] == "nuget"]
+          if os.environ["CASE"] == "custom":
+              host = next(d["host"] for d in rows if d["type"] == "custom")
+              print(f"https://{host}/{os.environ['REPO']}/v3/index.json")
+          else:
+              host = next(d["host"] for d in rows if d["type"] == "default")
+              print(f"https://{host}/{os.environ['WORKSPACE']}/{os.environ['REPO']}/v3/index.json")
+          EOF
+          )
+          echo "FEED=$feed" >> "$GITHUB_ENV"
+
+      - name: Write a consumer project with no feed credentials
+        run: |
+          set -euo pipefail
+          mkdir -p consumer
+          cat > consumer/Consumer.csproj <<'EOF'
+          <Project Sdk="Microsoft.NET.Sdk">
+            <PropertyGroup><TargetFramework>net10.0</TargetFramework></PropertyGroup>
+            <ItemGroup><PackageReference Include="Cloudsmith.Cli.NuGetProbe" Version="1.0.0" /></ItemGroup>
+          </Project>
+          EOF
+          cat > nuget.config <<EOF
+          <configuration><packageSources><clear /><add key="cloudsmith" value="$FEED" /></packageSources></configuration>
+          EOF
+
+      - name: Restore fails without the plugin
+        run: |
+          set +e
+          out=$(NUGET_PACKAGES="$RUNNER_TEMP/pkgs-denied" dotnet restore consumer --configfile nuget.config 2>&1)
+          code=$?
+          echo "$out"
+          test "$code" -ne 0
+          echo "$out" | grep -q 401
+
+      - name: Install the plugin
+        run: |
+          set -euo pipefail
+          # CLOUDSMITH_API_HOST comes from the environment, so the launcher bakes it in.
+          cloudsmith credential-helper install nuget --workspace "$WORKSPACE" --bin-dir "$RUNNER_TEMP/nuget-bin"
+          ls -la "$RUNNER_TEMP/nuget-bin"
+          cat "$RUNNER_TEMP/nuget-bin"/nuget-plugin-cloudsmith*
+          echo "$RUNNER_TEMP/nuget-bin" >> "$GITHUB_PATH"
+          cloudsmith credential-helper list
+
+      - name: Restore succeeds with the plugin
+        env:
+          NUGET_PLUGINS_CACHE_PATH: ${{ runner.temp }}/plugins-cache
+        run: |
+          set -euo pipefail
+          # Only the launcher knows the API host and the Workspace.
+          env -u CLOUDSMITH_API_HOST -u WORKSPACE NUGET_PACKAGES="$RUNNER_TEMP/pkgs-allowed" \
+            dotnet restore consumer --configfile nuget.config -v normal
+          test -d "$RUNNER_TEMP/pkgs-allowed/cloudsmith.cli.nugetprobe/1.0.0"
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Added
+
+- Added a NuGet credential provider. Run `cloudsmith credential-helper install nuget --workspace <workspace>` once. Then `dotnet restore`, MSBuild and Visual Studio authenticate to Cloudsmith feeds with your CLI credentials. They find the provider on PATH (.NET SDK 9.0.200 or later). The provider also covers the NuGet custom domains of the Workspace. No token is stored in `nuget.config`.
+
 ### Changed
 
 - `cloudsmith domains list` and the credential helpers now get the domains from `GET /v2/workspaces/{workspace}/domains/` on the configured API host. This list includes the Cloudsmith-owned hosts, so the CLI no longer contains a list of Cloudsmith hostnames. The CLI keeps a separate domain cache for each API host.
 
@@ -13,6 +13,7 @@
 from .docker import docker as docker_cmd
 from .generic import generic as generic_cmd
 from .manage import install_cmd, list_cmd, uninstall_cmd
+from .nuget import nuget as nuget_cmd
 from .pnpm import pnpm as pnpm_cmd
 from .terraform import terraform as terraform_cmd
 
@@ -37,6 +38,9 @@ def credential_helper():
     \b
         # Install cargo credential helper
         $ cloudsmith credential-helper install cargo
+    \b
+        # Install NuGet credential provider
+        $ cloudsmith credential-helper install nuget
     \b
         # Test Docker credential helper directly
         $ echo "docker.cloudsmith.io" | cloudsmith credential-helper docker
@@ -54,5 +58,6 @@ def credential_helper():
 credential_helper.add_command(list_cmd, name="list")
 credential_helper.add_command(cargo_cmd, name="cargo")
 credential_helper.add_command(terraform_cmd, name="terraform")
+credential_helper.add_command(nuget_cmd, name="nuget")
 
 main.add_command(credential_helper, name="credential-helper")
@@ -8,13 +8,19 @@
 
 from __future__ import annotations
 
+import os
 import sys
 from pathlib import Path
 
 import click
+from click.core import ParameterSource
 
 from cloudsmith_cli.credential_helpers.cargo.installer import CargoInstaller
 from cloudsmith_cli.credential_helpers.generic import PartialInstallError
+from cloudsmith_cli.credential_helpers.nuget.installer import (
+    NuGetInstaller,
+    NuGetInstallError,
+)
 from cloudsmith_cli.credential_helpers.pnpm.installer import PNPMInstaller
 from cloudsmith_cli.credential_helpers.terraform.installer import (
     TerraformHelperExeNotFound,
@@ -44,6 +50,7 @@
     "pnpm": PNPMInstaller,
     "cargo": CargoInstaller,
     "terraform": TerraformInstaller,
+    "nuget": NuGetInstaller,
 }
 
 
@@ -118,6 +125,51 @@ def _terraform_helper_args(ctx, opts, repo: str | None = None) -> tuple[str, ...
     return tuple(args)
 
 
+# Settings that have no CLI flag but change where the plugin finds credentials.
+_NUGET_KEYRING_PATHS = ("CLOUDSMITH_KEYRING_FILE_PATH", "CLOUDSMITH_KEYRING_DIR")
+_NUGET_ENV_ONLY_SETTINGS = (
+    "CLOUDSMITH_NO_KEYRING",
+    "CLOUDSMITH_KEYRING_BACKEND",
+    "CLOUDSMITH_KEYRING_FILE_PATH",
+    "CLOUDSMITH_KEYRING_DIR",
+)
+
+
+def _nuget_launcher_env(ctx, opts) -> dict[str, str]:
+    """Return the ``CLOUDSMITH_*`` settings to write into the NuGet launcher.
+
+    NuGet starts the plugin from IDEs and build agents that do not have this
+    shell's environment.  Only values from a flag or an environment variable
+    are kept, because the plugin reads the config files itself.  Secrets such
+    as the API key are never kept.
+    """
+    supplied = (ParameterSource.COMMANDLINE, ParameterSource.ENVIRONMENT)
+
+    def from_flag_or_env(param: str, value):
+        return value if ctx.get_parameter_source(param) in supplied else None
+
+    settings = {
+        "CLOUDSMITH_WORKSPACE": from_flag_or_env("org", opts.org),
+        "CLOUDSMITH_PROFILE": ctx.meta.get("profile"),
+        "CLOUDSMITH_CONFIG_FILE": ctx.meta.get("config_file"),
+        "CLOUDSMITH_CREDENTIALS_FILE": ctx.meta.get("creds_file"),
+        "CLOUDSMITH_API_HOST": from_flag_or_env("api_host", opts.api_host),
+        "CLOUDSMITH_API_PROXY": from_flag_or_env("api_proxy", opts.api_proxy),
+        "CLOUDSMITH_WITHOUT_API_SSL_VERIFY": from_flag_or_env(
+            "without_api_ssl_verify", "true" if opts.api_ssl_verify is False else None
+        ),
+        **{name: os.environ.get(name) for name in _NUGET_ENV_ONLY_SETTINGS},
+    }
+    for name in _NUGET_KEYRING_PATHS:
+        path = settings[name]
+        if path:
+            # NuGet runs the plugin without this shell's variables or directory.
+            settings[name] = os.path.abspath(
+                os.path.expanduser(os.path.expandvars(path))
+            )
+    return {name: value for name, value in settings.items() if value}
+
+
 _REPO_FLAGS = ("-r", "--repo", "--repository")
 
 
@@ -268,13 +320,16 @@ def install_cmd(
     if helper == "terraform":
         helper_args = _terraform_helper_args(ctx, opts, repo)
         install_kwargs["helper_args"] = helper_args
+    elif helper == "nuget":
+        install_kwargs["launcher_env"] = _nuget_launcher_env(ctx, opts)
 
     try:
         actions = installer.install(**install_kwargs)
     except (
         TerraformrcConflictError,
         TerraformHelperExeNotFound,
         TerraformPluginDirError,
+        NuGetInstallError,
     ) as exc:
         raise click.ClickException(str(exc))
     except OSError as exc:
 
@@ -0,0 +1,78 @@
+# Copyright 2026 Cloudsmith Ltd
+"""
+NuGet credential provider command.
+
+Implements the NuGet cross-platform authentication plugin protocol for
+Cloudsmith feeds.
+
+See:
+    https://learn.microsoft.com/en-us/nuget/reference/extensibility/nuget-cross-platform-plugins
+"""
+
+import sys
+
+import click
+
+from ....core.credentials.chain import CredentialProviderChain
+from ....credential_helpers.nuget import execute
+from ...decorators import common_api_auth_options, initialise_api
+
+
+def _utf8(stream, **kwargs):
+    """Switch a text stream to UTF-8, which the NuGet plugin protocol requires."""
+    try:
+        stream.reconfigure(encoding="utf-8", **kwargs)
+    except (AttributeError, ValueError, OSError):
+        pass
+    return stream
+
+
+@click.command(
+    context_settings={"ignore_unknown_options": True, "allow_interspersed_args": False}
+)
+@click.argument("nuget_args", nargs=-1, type=click.UNPROCESSED)
+@common_api_auth_options
+@initialise_api
+def nuget(opts, nuget_args):
+    """
+    NuGet credential provider for Cloudsmith feeds.
+
+    NuGet (dotnet, MSBuild, Visual Studio) runs this command through the
+    ``nuget-plugin-cloudsmith`` launcher that ``cloudsmith credential-helper
+    install nuget`` puts on PATH, passing ``-Plugin`` after ``--``.  It then
+    speaks the NuGet cross-platform plugin protocol on stdin/stdout.
+
+    Provides credentials for all Cloudsmith NuGet feeds: ``*.cloudsmith.io``,
+    ``*.cloudsmith.com``, and any NuGet custom domains configured for the
+    Workspace (requires a Workspace - ``--workspace``, CLOUDSMITH_WORKSPACE,
+    or ``workspace`` in ``config.ini``; legacy aliases are also accepted - and
+    a valid API key/token).  Any other feed is declined so NuGet falls back to
+    its other credential sources.
+
+    \b
+    Examples:
+
+    \b
+        # Called by NuGet via the launcher
+        $ nuget-plugin-cloudsmith -Plugin
+
+    \b
+    Environment variables:
+        CLOUDSMITH_API_KEY: API key for authentication (optional)
+        CLOUDSMITH_WORKSPACE: Workspace slug (CLOUDSMITH_ORG is also accepted)
+    """
+    exit_code, stderr = execute(
+        nuget_args,
+        _utf8(sys.stdin),
+        _utf8(sys.stdout, newline="\n"),
+        credential=opts.credential,
+        api_host=opts.api_host,
+        workspace=opts.org,
+        refresh_credential=lambda: CredentialProviderChain().resolve(
+            opts.credential_context
+        ),
+    )
+
+    if stderr is not None:
+        click.echo(stderr, err=True)
+    sys.exit(exit_code)
@@ -586,6 +586,7 @@ def wrapper(ctx, *args, **kwargs):
             click.secho(message, fg="yellow", err=True)
 
         opts.credential = credential
+        opts.credential_context = context
 
         kwargs["opts"] = opts
         return ctx.invoke(f, *args, **kwargs)