diff --git a/.forgejo/workflows/publish.yml b/.forgejo/workflows/publish.yml
new file mode 100644
index 0000000..ca66daa
--- /dev/null
+++ b/.forgejo/workflows/publish.yml
@@ -0,0 +1,36 @@
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  image:
+    name: Publish NuGet packages
+    runs-on: docker
+    container: git.frostfs.info/truecloudlab/env:dotnet-8.0
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Build NuGet packages
+        # `dotnet build` implies and replaces `dotnet pack` thanks to `GeneratePackageOnBuild`
+        run: dotnet build
+
+      - name: Publish NuGet packages
+        run: |-
+          dotnet nuget add source \
+            --name "$NUGET_REGISTRY" \
+            --username "$NUGET_REGISTRY_USER" \
+            --password "$NUGET_REGISTRY_PASSWORD" \
+            --store-password-in-clear-text \
+            "$NUGET_REGISTRY_URL"
+          find -iname '*.nupkg' | grep . | xargs -d'\n' -t -n1 \
+            dotnet nuget push --source "$NUGET_REGISTRY"
+        env:
+          NUGET_REGISTRY: TrueCloudLab
+          NUGET_REGISTRY_URL: https://git.frostfs.info/api/packages/TrueCloudLab/nuget/index.json
+          NUGET_REGISTRY_USER: ${{secrets.NUGET_REGISTRY_USER}}
+          NUGET_REGISTRY_PASSWORD: ${{secrets.NUGET_REGISTRY_PASSWORD}}
+        if: >-
+          startsWith(github.ref, 'refs/tags/v') &&
+          (github.event_name == 'workflow_dispatch' || github.event_name == 'push')