diff --git a/.github/workflows/bootstrap.yml b/.github/workflows/bootstrap.yml
new file mode 100644
index 0000000..20a2105
--- /dev/null
+++ b/.github/workflows/bootstrap.yml
@@ -0,0 +1,42 @@
+name: Bootstrap new npm packages
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  bootstrap:
+    name: Bootstrap broker and Devframe packages
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment: npm
+    steps:
+      - name: 📥 Checkout main
+        uses: actions/checkout@v7
+        with:
+          ref: main
+
+      - name: 🔒 Require main
+        run: test "$GITHUB_REF" = refs/heads/main
+
+      - name: 🏗️ Set up workspace
+        uses: ./.github/actions/setup-workspace
+
+      # Temporary package creation enables npm's per-package trusted-publisher settings.
+      - name: 🏷️ Set bootstrap versions
+        run: pnpm --filter @dvcol/cdb-broker --filter @dvcol/cdb-devframe exec npm pkg set version=0.0.0
+
+      - name: ✅ Build and validate new packages
+        run: pnpm exec turbo run check:package --filter=@dvcol/cdb-broker --filter=@dvcol/cdb-devframe --concurrency=1
+
+      - name: 🚀 Publish bootstrap packages
+        run: pnpm --filter @dvcol/cdb-broker --filter @dvcol/cdb-devframe publish --recursive --tag bootstrap --access public --provenance --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_BOOTSTRAP_TOKEN }}