diff --git a/.github/workflows/packages-publish.yml b/.github/workflows/packages-publish.yml
new file mode 100644
index 0000000000..80d459596f
--- /dev/null
+++ b/.github/workflows/packages-publish.yml
@@ -0,0 +1,137 @@
+name: packages publish
+
+# Publishes the versions of simplex-chat and @simplex-chat/types (npm) and simplex-chat (PyPI)
+# that are not published yet, after a release PR (packages-release-pr.yml) is merged into master or stable.
+# npm prerelease versions get dist-tag beta, others latest.
+
+# Publishing uses trusted publishing (OIDC) for this workflow on npm and PyPI,
+# or the NPM_TOKEN and PYPI_API_TOKEN secrets when they are set.
+# Test repositories: variables NPM_SCOPE, PYPI_PROJECT and PYPI_URL / PYPI_UPLOAD_URL (TestPyPI)
+# publish under other names.
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+      - stable
+    paths:
+      - "packages/simplex-chat-nodejs/package.json"
+      # pins can change without a version bump while that version is not published yet
+      - "packages/simplex-chat-nodejs/src/release.ts"
+      - "packages/simplex-chat-client/types/typescript/package.json"
+      - "packages/simplex-chat-python/src/simplex_chat/_version.py"
+
+concurrency:
+  group: packages-publish-${{ github.ref }}
+  cancel-in-progress: false
+
+# Each published version is tagged <package>-v<version> on the commit it was published from:
+# the release PR bumps a package that changed since that tag.
+
+permissions:
+  contents: write
+  id-token: write
+
+env:
+  NPM_SCOPE: ${{ vars.NPM_SCOPE }}
+  PYPI_PROJECT: ${{ vars.PYPI_PROJECT }}
+  PYPI_URL: ${{ vars.PYPI_URL }}
+
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    outputs:
+      types_version: ${{ steps.plan.outputs.types_version }}
+      types_dist_tag: ${{ steps.plan.outputs.types_dist_tag }}
+      nodejs_version: ${{ steps.plan.outputs.nodejs_version }}
+      nodejs_dist_tag: ${{ steps.plan.outputs.nodejs_dist_tag }}
+      python_version: ${{ steps.plan.outputs.python_version }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Versions to publish
+        id: plan
+        run: python3 scripts/ci/packages_release.py publish-plan >> "$GITHUB_OUTPUT"
+
+  npm:
+    needs: plan
+    if: needs.plan.outputs.types_version || needs.plan.outputs.nodejs_version
+    runs-on: ubuntu-latest
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      # Before the test names: the build installs @simplex-chat/types from this repository.
+      - name: Build and test simplex-chat
+        if: needs.plan.outputs.nodejs_version
+        working-directory: packages/simplex-chat-nodejs
+        run: |
+          (cd ../simplex-chat-client/types/typescript && npm install --no-audit --no-fund && npx tsc)
+          npm install --ignore-scripts --no-save --no-audit --no-fund ../simplex-chat-client/types/typescript
+          npx tsc && cp src/simplex.* dist
+          npx jest tests/libs.test.ts tests/api.unit.test.ts
+
+      - name: Use test package names
+        if: vars.NPM_SCOPE
+        run: python3 scripts/ci/packages_release.py test-names
+
+      - name: Publish @simplex-chat/types
+        if: needs.plan.outputs.types_version
+        working-directory: packages/simplex-chat-client/types/typescript
+        run: |
+          npm install --no-audit --no-fund
+          npm publish --provenance --access public --tag ${{ needs.plan.outputs.types_dist_tag }}
+          git tag "types-v${{ needs.plan.outputs.types_version }}" && git push origin "types-v${{ needs.plan.outputs.types_version }}"
+
+      - name: Publish simplex-chat
+        if: needs.plan.outputs.nodejs_version
+        working-directory: packages/simplex-chat-nodejs
+        run: |
+          npm publish --provenance --access public --tag ${{ needs.plan.outputs.nodejs_dist_tag }}
+          git tag "nodejs-v${{ needs.plan.outputs.nodejs_version }}" && git push origin "nodejs-v${{ needs.plan.outputs.nodejs_version }}"
+
+  pypi:
+    needs: plan
+    if: needs.plan.outputs.python_version
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Use test package name
+        if: vars.PYPI_PROJECT
+        run: python3 scripts/ci/packages_release.py test-names
+
+      - name: Build and test simplex-chat
+        working-directory: packages/simplex-chat-python
+        run: |
+          python -m pip install build -e ".[test]"
+          python -m pytest -q
+          python -m build
+
+      - name: Publish simplex-chat
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: packages/simplex-chat-python/dist
+          repository-url: ${{ vars.PYPI_UPLOAD_URL || 'https://upload.pypi.org/legacy/' }}
+          password: ${{ secrets.PYPI_API_TOKEN }}
+
+      - name: Tag the published version
+        run: git tag "python-v${{ needs.plan.outputs.python_version }}" && git push origin "python-v${{ needs.plan.outputs.python_version }}"