diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml
new file mode 100644
index 0000000..ba39b68
--- /dev/null
+++ b/.github/workflows/publish-nuget.yml
@@ -0,0 +1,43 @@
+name: Publish NuGet Package
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish to nuget.org
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Restore
+        run: dotnet restore Testing.sln --verbosity minimal
+
+      - name: Build
+        run: dotnet build Testing.sln --configuration Release --no-restore --verbosity minimal -m:1
+
+      - name: Test
+        run: dotnet test Testing.sln --configuration Release --no-build --verbosity minimal -m:1
+
+      - name: Pack
+        run: dotnet pack src/Testing/Testing.csproj --configuration Release --no-build --output artifacts/packages --verbosity minimal
+
+      - name: Publish to nuget.org
+        run: >
+          dotnet nuget push "artifacts/packages/*.nupkg"
+          --api-key "${{ secrets.NUGET_API_KEY }}"
+          --source https://api.nuget.org/v3/index.json
+          --skip-duplicate
diff --git a/README.md b/README.md
index 15fe0b9..db0531c 100644
--- a/README.md
+++ b/README.md
@@ -29,4 +29,12 @@ Pack the library:
 dotnet pack .\src\Testing\Testing.csproj --configuration Release --output .\artifacts\packages
 ```
 
+## Publishing
+
+Packages are published to nuget.org automatically when changes are merged into `master`.
+
+Configure a GitHub Actions repository secret named `NUGET_API_KEY` with a nuget.org API key that has permission to push `Atya.Governance.Testing`.
+
+NuGet package versions are immutable. Update the package `<Version>` in `src/Testing/Testing.csproj` before merging a release change, otherwise nuget.org will reject the already-published version.
+
 For local package-feed publishing, see [LOCAL_NUGET.md](LOCAL_NUGET.md).
diff --git a/Testing.sln b/Testing.sln
index 7c22093..fa3fc7a 100644
--- a/Testing.sln
+++ b/Testing.sln
@@ -18,6 +18,7 @@ EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution items", "Solution items", "{02EA681E-C7D8-13C7-8484-4AC65E1B71E8}"
 	ProjectSection(SolutionItems) = preProject
 		.github\workflows\ci.yml = .github\workflows\ci.yml
+		.github\workflows\publish-nuget.yml = .github\workflows\publish-nuget.yml
 		.editorconfig = .editorconfig
 		.gitattributes = .gitattributes
 		.gitignore = .gitignore