diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 9a75f23..eacd8e0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -131,3 +131,54 @@ jobs:
           fi
 
           echo "Version/changelog gate passed: $BASE_VERSION -> $PR_VERSION"
+
+  publish:
+    name: publish
+    runs-on: ubuntu-latest
+    needs:
+      - format
+      - analyze
+      - test
+      - pana
+      - version_and_changelog
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Dart
+        uses: dart-lang/setup-dart@v1
+      - name: Publish package on push to main
+        env:
+          PUB_CREDENTIALS_JSON: ${{ secrets.PUB_CREDENTIALS_JSON }}
+        run: |
+          set -euo pipefail
+
+          if [ "${GITHUB_EVENT_NAME}" != "push" ] || [ "${GITHUB_REF}" != "refs/heads/main" ]; then
+            echo "Not a push to main; skipping publish."
+            exit 0
+          fi
+
+          PACKAGE_NAME="$(sed -nE 's/^name:\s*([^[:space:]]+)\s*$/\1/p' pubspec.yaml | head -n1)"
+          PACKAGE_VERSION="$(sed -nE 's/^version:\s*([^[:space:]]+)\s*$/\1/p' pubspec.yaml | head -n1)"
+
+          if [ -z "$PACKAGE_NAME" ] || [ -z "$PACKAGE_VERSION" ]; then
+            echo "Failed to parse package name/version from pubspec.yaml."
+            exit 1
+          fi
+
+          if curl -fsSL "https://pub.dev/api/packages/${PACKAGE_NAME}" | grep -q "\"version\":\"${PACKAGE_VERSION}\""; then
+            echo "${PACKAGE_NAME} ${PACKAGE_VERSION} is already published; skipping."
+            exit 0
+          fi
+
+          if [ -z "${PUB_CREDENTIALS_JSON:-}" ]; then
+            echo "Missing required secret PUB_CREDENTIALS_JSON."
+            exit 1
+          fi
+
+          mkdir -p "$HOME/.pub-cache"
+          printf '%s' "$PUB_CREDENTIALS_JSON" > "$HOME/.pub-cache/credentials.json"
+          chmod 600 "$HOME/.pub-cache/credentials.json"
+
+          dart pub get
+          dart pub publish --dry-run
+          dart pub publish --force