diff --git a/.github/workflows/publish-post-encrypt.yml b/.github/workflows/publish-post-encrypt.yml
new file mode 100644
index 00000000..31677608
--- /dev/null
+++ b/.github/workflows/publish-post-encrypt.yml
@@ -0,0 +1,43 @@
+name: Publish post-encrypt
+
+on:
+  push:
+    tags:
+      - 'post-encrypt-v*.*.*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-post-encrypt-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - uses: pnpm/action-setup@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          registry-url: 'https://registry.npmjs.org'
+          cache: pnpm
+          scope: '@hugo-fixit'
+
+      - name: Update npm
+        run: npm install -g npm@latest
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build package
+        run: pnpm -F post-encrypt build
+
+      - name: Publish package to npm
+        working-directory: packages/post-encrypt
+        run: npm publish --access public --provenance
diff --git a/packages/post-encrypt/package.json b/packages/post-encrypt/package.json
index d916e2ac..e6dd114b 100644
--- a/packages/post-encrypt/package.json
+++ b/packages/post-encrypt/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@hugo-fixit/post-encrypt",
   "type": "module",
-  "version": "0.1.0",
+  "version": "0.0.0",
   "description": "Post-build AES-256-GCM encryption tool for the FixIt Hugo theme",
   "author": "Lruihao",
   "license": "MIT",
diff --git a/packages/post-encrypt/publish.sh b/packages/post-encrypt/publish.sh
new file mode 100755
index 00000000..de9c1d72
--- /dev/null
+++ b/packages/post-encrypt/publish.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  ./publish.sh <patch|minor|major|prerelease|preminor|premajor|version>
+
+Examples:
+  ./publish.sh patch
+  ./publish.sh minor
+  ./publish.sh 1.2.3
+EOF
+}
+
+if [[ "${1:-}" == "" ]] || [[ "${1:-}" == "-h" ]] || [[ "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+bump="$1"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "${script_dir}/../.." && pwd)"
+package_json_rel="packages/post-encrypt/package.json"
+package_json_abs="${repo_root}/${package_json_rel}"
+
+if [[ ! -f "${package_json_abs}" ]]; then
+  echo "Cannot find ${package_json_rel}" >&2
+  exit 1
+fi
+
+if [[ -n "$(git -C "${repo_root}" status --porcelain)" ]]; then
+  echo "Working tree is not clean. Commit or stash changes before release." >&2
+  exit 1
+fi
+
+npm --prefix "${script_dir}" version "${bump}" --no-git-tag-version > /dev/null
+version="$(node -p "require('${package_json_abs}').version")"
+
+tag="post-encrypt-v${version}"
+commit_msg="chore(release): post-encrypt ${version}"
+tag_msg="release: @hugo-fixit/post-encrypt ${version}"
+
+if git -C "${repo_root}" rev-parse -q --verify "refs/tags/${tag}" > /dev/null; then
+  echo "Tag already exists: ${tag}" >&2
+  exit 1
+fi
+
+git -C "${repo_root}" add "${package_json_rel}"
+git -C "${repo_root}" commit -m "${commit_msg}"
+git -C "${repo_root}" tag -a "${tag}" -m "${tag_msg}"
+
+echo "Released @hugo-fixit/post-encrypt ${version}"
+echo "Created commit: ${commit_msg}"
+echo "Created tag: ${tag}"
+echo "Next: git push origin main --follow-tags"