diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
new file mode 100644
index 00000000..fb1f8b70
--- /dev/null
+++ b/.github/workflows/npm-publish.yml
@@ -0,0 +1,79 @@
+name: NPM Publish
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Perform a dry run (skip actual publish)'
+        required: true
+        type: boolean
+        default: true
+
+# Ensure only one publish runs at a time
+concurrency:
+  group: npm-publish
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  prebuild-x64:
+    if: github.repository == 'RobotWebTools/rclnodejs'
+    uses: ./.github/workflows/prebuild-linux-x64.yml
+
+  prebuild-arm64:
+    if: github.repository == 'RobotWebTools/rclnodejs'
+    uses: ./.github/workflows/prebuild-linux-arm64.yml
+
+  publish:
+    needs: [prebuild-x64, prebuild-arm64]
+    runs-on: ubuntu-latest
+    environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Download x64 prebuilds
+        uses: actions/download-artifact@v7
+        with:
+          pattern: prebuilt-linux-x64-*
+          path: prebuilds/linux-x64
+          merge-multiple: true
+
+      - name: Download arm64 prebuilds
+        uses: actions/download-artifact@v7
+        with:
+          pattern: prebuilt-linux-arm64-*
+          path: prebuilds/linux-arm64
+          merge-multiple: true
+
+      - name: List prebuilds
+        run: |
+          echo "=== x64 prebuilds ==="
+          ls -la prebuilds/linux-x64/
+          echo "=== arm64 prebuilds ==="
+          ls -la prebuilds/linux-arm64/
+
+      - name: Pack
+        run: ./scripts/npm-pack.sh
+
+      - name: Publish
+        run: |
+          if [[ "${{ inputs.dry_run }}" == "true" ]]; then
+            echo "=== DRY RUN ==="
+            npm publish --provenance --access public --dry-run ./dist/rclnodejs-*.tgz
+          else
+            npm publish --provenance --access public ./dist/rclnodejs-*.tgz
+          fi
diff --git a/.github/workflows/prebuild-linux-arm64.yml b/.github/workflows/prebuild-linux-arm64.yml
index 1b35bd22..6a854e35 100644
--- a/.github/workflows/prebuild-linux-arm64.yml
+++ b/.github/workflows/prebuild-linux-arm64.yml
@@ -2,9 +2,7 @@ name: Prebuild Linux ARM64
 
 on:
   workflow_dispatch:
-  push:
-    tags:
-      - '*'
+  workflow_call:
 
 jobs:
   prebuild:
@@ -46,7 +44,7 @@ jobs:
       with:
         required-ros-distributions: ${{ matrix.ros_distribution }}
 
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       shell: bash
@@ -61,7 +59,7 @@ jobs:
         npm run prebuild
 
     - name: Upload prebuilt binary
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: prebuilt-linux-arm64-node${{ matrix.node-version }}-${{ matrix.ubuntu_codename }}-${{ matrix.ros_distribution }}
         path: prebuilds/linux-arm64/*.node
diff --git a/.github/workflows/prebuild-linux-x64.yml b/.github/workflows/prebuild-linux-x64.yml
index 2603acf1..c7458d31 100644
--- a/.github/workflows/prebuild-linux-x64.yml
+++ b/.github/workflows/prebuild-linux-x64.yml
@@ -2,9 +2,7 @@ name: Prebuild Linux x64
 
 on:
   workflow_dispatch:
-  push:
-    tags:
-      - '*'
+  workflow_call:
 
 jobs:
   prebuild:
@@ -46,7 +44,7 @@ jobs:
       with:
         required-ros-distributions: ${{ matrix.ros_distribution }}
 
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     - name: Install dependencies
       shell: bash
@@ -61,7 +59,7 @@ jobs:
         npm run prebuild
 
     - name: Upload prebuilt binary
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: prebuilt-linux-x64-node${{ matrix.node-version }}-${{ matrix.ubuntu_codename }}-${{ matrix.ros_distribution }}
         path: prebuilds/linux-x64/*.node