diff --git a/.github/workflows/publishing.yml b/.github/workflows/publishing.yml
new file mode 100644
index 000000000..56d29d719
--- /dev/null
+++ b/.github/workflows/publishing.yml
@@ -0,0 +1,100 @@
+name: publishing
+
+on: push
+
+env:
+  POETRY_VERSION: "1.7.1"
+  POETRY_DYNAMIC_VERSIONING_VERSION: "1.2.0"
+  ALIRE_VERSION: "1.2.2"
+
+jobs:
+  build:
+    name: Build distribution
+    runs-on: ubuntu-20.04
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Poetry
+        run: |
+          # TODO(eng/recordflux/RecordFlux#1531): Remove installation of Poetry (and remove caching)
+          pipx install poetry==${{ env.POETRY_VERSION }}
+          pipx inject poetry poetry-dynamic-versioning==${{ env.POETRY_DYNAMIC_VERSIONING_VERSION }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: |
+            3.8
+            3.9
+            3.10
+            3.11
+            3.12
+          cache: poetry
+      - name: Install Alire
+        uses: alire-project/setup-alire@v2
+        with:
+          version: ${{ env.ALIRE_VERSION }}
+          toolchain: "--disable-assistant"
+      - name: Install GNAT
+        run: |
+          make install_gnat
+      - name: Build distribution
+        run: |
+          eval `make printenv_gnat`
+          gnat --version
+          # TODO(eng/recordflux/RecordFlux#1531): Remove explicit initialization
+          make init pypi_dist
+      - name: Store distribution packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish-to-pypi:
+    name: Publish Python distribution to PyPI
+    if: startsWith(github.ref, 'refs/tags/')
+    needs:
+      - build
+    runs-on: ubuntu-20.04
+
+    environment:
+      name: pypi
+      url: https://pypi.org/p/RecordFlux
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download dists
+        uses: actions/download-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+      - name: Publish distribution to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  publish-to-testpypi:
+    name: Publish Python distribution to TestPyPI
+    if: github.ref == 'refs/heads/main'
+    needs:
+      - build
+    runs-on: ubuntu-20.04
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/RecordFlux
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download dists
+        uses: actions/download-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+      - name: Publish distribution to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
diff --git a/Makefile b/Makefile
index 3e9bcfa5e..ef687ca97 100644
--- a/Makefile
+++ b/Makefile
@@ -317,6 +317,12 @@ dist: $(SDIST)
 $(SDIST): rflx/lang $(VSIX) pyproject.toml $(wildcard bin/*) $(wildcard rflx/*)
 	poetry build -vv --no-cache
 
+PYTHON_VERSIONS ?= 3.8 3.9 3.10 3.11 3.12
+
+pypi_dist:
+	# Build distributions without local version identifier
+	$(foreach version,$(PYTHON_VERSIONS),poetry env use $(version) && $(MAKE) install_build_deps dist POETRY_DYNAMIC_VERSIONING_BYPASS=$$(poetry version -s | sed 's/+.*//') || exit;)
+
 anod_dist: rflx/lang pyproject.toml $(wildcard bin/*) $(wildcard rflx/*)
 	poetry build -vv --no-cache