diff --git a/.github/workflows/build-csharp.yml b/.github/workflows/build-csharp.yml
index ef78c7e..008633f 100644
--- a/.github/workflows/build-csharp.yml
+++ b/.github/workflows/build-csharp.yml
@@ -7,6 +7,8 @@ on:
       - "src/csharp/**"
       - "PyMCU.SDK.slnx"
       - ".github/workflows/build-csharp.yml"
+    tags:
+      - "v*"
   pull_request:
     branches: [main]
     paths:
@@ -18,6 +20,8 @@ jobs:
   build:
     name: Build & pack NuGet
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -49,3 +53,68 @@ jobs:
           if-no-files-found: error
           retention-days: 30
 
+  publish-private:
+    name: Publish to private NuGet feed
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref_type == 'branch'
+    permissions:
+      contents: read
+
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: PyMCU.Backend.SDK-nupkg
+          path: artifacts/
+
+      - name: Connect to headscale network
+        uses: tailscale/github-action@v3
+        with:
+          authkey: ${{ secrets.HEADSCALE_AUTH_KEY }}
+          login-server: ${{ secrets.HEADSCALE_URL }}
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Publish to private NuGet feed
+        env:
+          PRIVATE_NUGET_URL: ${{ secrets.PRIVATE_NUGET_URL }}
+          PRIVATE_NUGET_API_KEY: ${{ secrets.PRIVATE_NUGET_API_KEY }}
+        run: |
+          dotnet nuget push artifacts/*.nupkg \
+            --source "$PRIVATE_NUGET_URL" \
+            --api-key "$PRIVATE_NUGET_API_KEY" \
+            --skip-duplicate
+
+  publish-public:
+    name: Publish to NuGet.org
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref_type == 'tag'
+    environment: nuget
+    permissions:
+      contents: read
+
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: PyMCU.Backend.SDK-nupkg
+          path: artifacts/
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Publish to NuGet.org
+        env:
+          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        run: |
+          dotnet nuget push artifacts/*.nupkg \
+            --source https://api.nuget.org/v3/index.json \
+            --api-key "$NUGET_API_KEY" \
+            --skip-duplicate
diff --git a/.github/workflows/build-python.yml b/.github/workflows/build-python.yml
index a6977de..825dc75 100644
--- a/.github/workflows/build-python.yml
+++ b/.github/workflows/build-python.yml
@@ -6,16 +6,21 @@ on:
       - "src/python/**"
       - "pyproject.toml"
       - ".github/workflows/build-python.yml"
+    tags:
+      - "v*"
   pull_request:
     branches: [main]
     paths:
       - "src/python/**"
       - "pyproject.toml"
       - ".github/workflows/build-python.yml"
+
 jobs:
   build:
     name: Build wheel & sdist
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -24,7 +29,7 @@ jobs:
         with:
           python-version: "3.11"
       - name: Install Hatch
-        run: pip install "hatch>=1.25.0"
+        run: pip install "hatch>=1.0.0"
       - name: Build
         run: hatch build
       - name: Upload artifacts
@@ -34,3 +39,57 @@ jobs:
           path: dist/
           if-no-files-found: error
           retention-days: 30
+
+  publish-private:
+    name: Publish to private PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref_type == 'branch'
+    permissions:
+      contents: read
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: pymcu-plugin-sdk-dist
+          path: dist/
+
+      - name: Connect to headscale network
+        uses: tailscale/github-action@v3
+        with:
+          authkey: ${{ secrets.HEADSCALE_AUTH_KEY }}
+          login-server: ${{ secrets.HEADSCALE_URL }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install Twine
+        run: pip install twine
+
+      - name: Publish to private registry
+        env:
+          TWINE_REPOSITORY_URL: ${{ secrets.PRIVATE_PYPI_URL }}
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PRIVATE_PYPI_TOKEN }}
+        run: twine upload dist/*
+
+  publish-public:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref_type == 'tag'
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: pymcu-plugin-sdk-dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1