diff --git a/.changelog/_unreleased.toml b/.changelog/_unreleased.toml
new file mode 100644
index 00000000..bf31da97
--- /dev/null
+++ b/.changelog/_unreleased.toml
@@ -0,0 +1,5 @@
+[[entries]]
+id = "69495c76-ca33-4089-87df-ee64b280c939"
+type = "improvement"
+description = "publish from CI"
+author = "@NiklasRosenstein"
diff --git a/.github/workflows/on-commit.yaml b/.github/workflows/on-commit.yaml
index 26d1d320..0edb8651 100644
--- a/.github/workflows/on-commit.yaml
+++ b/.github/workflows/on-commit.yaml
@@ -164,3 +164,25 @@ jobs:
       with: { python-version: "${{ matrix.python-version }}" }
     - run: slap config --venv-type=uv && slap install --link --no-venv-check ${{ matrix.only }}
     - run: cd examples/docker-manual && kraken run :dockerBuild :sub:helloWorld
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: test
+    environment: release
+    permissions:
+      id-token: write
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: NiklasRosenstein/slap@gha/install/v1
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+      - name: Build dist
+        run: slap publish --dry --build-directory dist/
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/