diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..5ac5d29
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,38 @@
+name: Publish Android package
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Maven version to publish (for example 0.1.0-alpha.1)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+      - uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: 8.14.3
+      - name: Test and publish GitHub Package
+        run: >-
+          gradle
+          :amll:testDebugUnitTest
+          :amll:assembleRelease
+          :amll:publishReleasePublicationToGitHubPackagesRepository
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          AMLL_VERSION: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.version }}
diff --git a/amll/build.gradle.kts b/amll/build.gradle.kts
index 942685c..d84af23 100644
--- a/amll/build.gradle.kts
+++ b/amll/build.gradle.kts
@@ -53,6 +53,15 @@ dependencies {
     testImplementation("junit:junit:4.13.2")
 }
 
+val publicationVersion =
+    providers.environmentVariable("AMLL_VERSION")
+        .orElse(providers.gradleProperty("amllVersion"))
+        .orElse("0.1.0-SNAPSHOT")
+        .map { it.removePrefix("v") }
+
+val githubActor = providers.environmentVariable("GITHUB_ACTOR")
+val githubToken = providers.environmentVariable("GITHUB_TOKEN")
+
 afterEvaluate {
     publishing {
         publications {
@@ -60,7 +69,22 @@ afterEvaluate {
                 from(components["release"])
                 groupId = "dev.yaqmc"
                 artifactId = "amll-android"
-                version = "0.1.0-SNAPSHOT"
+                version = publicationVersion.get()
+            }
+        }
+
+        // Keep ordinary local/PR builds credential-free. GitHub Packages is only registered when
+        // both credentials are present, which GitHub Actions supplies in the publish workflow.
+        if (githubActor.isPresent && githubToken.isPresent) {
+            repositories {
+                maven {
+                    name = "GitHubPackages"
+                    url = uri("https://maven.pkg.github.com/YAQMC/amll-android")
+                    credentials {
+                        username = githubActor.get()
+                        password = githubToken.get()
+                    }
+                }
             }
         }
     }