diff --git a/.github/workflows/publish-sdk.yml b/.github/workflows/publish-sdk.yml
new file mode 100644
index 000000000..988765ffb
--- /dev/null
+++ b/.github/workflows/publish-sdk.yml
@@ -0,0 +1,84 @@
+name: Publish SDK
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: "Publish mode"
+        required: true
+        default: Publish
+        type: choice
+        options:
+          - Publish
+          - Dry run
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish @termix-ssh/plugin-sdk
+    runs-on: ubuntu-latest
+
+    env:
+      NODE_OPTIONS: "--max-old-space-size=4096"
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Update npm
+        run: npm install -g npm@^11.19.0
+
+      - run: npm ci
+
+      - name: Check the version is new
+        run: |
+          VERSION=$(node -p "require('./packages/plugin-sdk/package.json').version")
+          if npm view "@termix-ssh/plugin-sdk@$VERSION" version >/dev/null 2>&1; then
+            echo "@termix-ssh/plugin-sdk@$VERSION is already on npm. Bump packages/plugin-sdk/package.json first."
+            if [ "${{ inputs.mode }}" = "Publish" ]; then
+              exit 1
+            fi
+          fi
+          echo "Publishing @termix-ssh/plugin-sdk@$VERSION"
+
+      - run: npm run build:sdk
+
+      - run: npm run lint
+
+      - run: npm run type-check
+
+      - run: npm run test
+
+      - name: Publish
+        run: |
+          if [ "${{ inputs.mode }}" = "Dry run" ]; then
+            npm publish --workspace @termix-ssh/plugin-sdk --provenance --access public --dry-run
+          else
+            npm publish --workspace @termix-ssh/plugin-sdk --provenance --access public
+          fi
+
+      - name: Tag and release
+        if: ${{ inputs.mode == 'Publish' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION=$(node -p "require('./packages/plugin-sdk/package.json').version")
+          node -e "
+            const fs = require('fs');
+            const { changelogSection } = require('./packages/plugin-sdk/dist/changelog.js');
+            const notes = changelogSection(fs.readFileSync('packages/plugin-sdk/CHANGELOG.md', 'utf8'), process.argv[1]);
+            fs.writeFileSync('sdk-notes.md', notes);
+          " "$VERSION"
+          gh release create "sdk-v$VERSION" \
+            --target "${{ github.sha }}" \
+            --title "Plugin SDK v$VERSION" \
+            --notes-file sdk-notes.md \
+            --latest=false