diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..437af68
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,16 @@
+name: Publish to pub.dev
+
+on:
+  push:
+    # Keep this pattern aligned with the `v{{version}}` pattern configured on
+    # the package's pub.dev automated publishing settings.
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+jobs:
+  publish:
+    # pub.dev authenticates this workflow with a short-lived OIDC token.
+    # No long-lived pub.dev credential is stored in GitHub secrets.
+    permissions:
+      id-token: write
+    uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1