diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f376f40..1e116a7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 10.0.x
 
       - name: Restore
         run: dotnet restore .\CodeQuality.sln --verbosity minimal
diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml
new file mode 100644
index 0000000..d1e8615
--- /dev/null
+++ b/.github/workflows/publish-nuget.yml
@@ -0,0 +1,39 @@
+name: Publish NuGet
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Restore
+        run: dotnet restore .\CodeQuality.sln --verbosity minimal
+
+      - name: Build
+        run: dotnet build .\CodeQuality.sln --configuration Release --no-restore --verbosity minimal
+
+      - name: Pack
+        run: dotnet pack .\src\CodeQuality\CodeQuality.csproj --configuration Release --no-build --output .\artifacts\packages --verbosity minimal
+
+      - name: Publish to nuget.org
+        run: >
+          dotnet nuget push ".\artifacts\packages\*.nupkg"
+          --api-key "${{ secrets.NUGET_API_KEY }}"
+          --source https://api.nuget.org/v3/index.json
+          --skip-duplicate
diff --git a/CodeQuality.sln b/CodeQuality.sln
index 9f5b30b..ede0dcc 100644
--- a/CodeQuality.sln
+++ b/CodeQuality.sln
@@ -19,6 +19,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution items", "Solution
 		Directory.Build.props = Directory.Build.props
 		Directory.Packages.props = Directory.Packages.props
 		.github\workflows\ci.yml = .github\workflows\ci.yml
+		.github\workflows\publish-nuget.yml = .github\workflows\publish-nuget.yml
 		LICENSE = LICENSE
 		LOCAL_NUGET.md = LOCAL_NUGET.md
 		Publish-LocalNuGet.ps1 = Publish-LocalNuGet.ps1
diff --git a/README.md b/README.md
index d531cb2..bb29feb 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,14 @@ dotnet build .\CodeQuality.sln --configuration Release --no-restore --verbosity
 dotnet pack .\src\CodeQuality\CodeQuality.csproj --configuration Release --no-build --verbosity minimal
 ```
 
+## Publishing
+
+Packages are published to nuget.org automatically when changes are merged into `master`.
+
+Configure a GitHub Actions repository secret named `NUGET_API_KEY` with a nuget.org API key that has permission to push `Atya.Governance.CodeQuality`.
+
+NuGet package versions are immutable. Update the package `<Version>` in `src/CodeQuality/CodeQuality.csproj` before merging a release change, otherwise nuget.org will reject the already-published version.
+
 ## Layout
 
 - `src/CodeQuality` - NuGet package project and packaged analyzer configuration.