diff --git a/.github/workflows/publish-aauth.yml b/.github/workflows/publish-aauth.yml
new file mode 100644
index 0000000..e52a37d
--- /dev/null
+++ b/.github/workflows/publish-aauth.yml
@@ -0,0 +1,70 @@
+name: Publish introspection-aauth to PyPI
+
+run-name: "Publish ${{ inputs.tag || github.ref_name }}"
+
+# packages/introspection-aauth is its own distribution, released by
+# release-please as `introspection-aauth-v*` tags. PyPI trusts this workflow
+# file and the `publish` environment for the `introspection-aauth` project.
+on:
+  push:
+    tags:
+      - "introspection-aauth-v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to publish, e.g. introspection-aauth-v1.0.0"
+        required: true
+        type: string
+
+concurrency:
+  group: release-publish-aauth
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish ${{ inputs.tag || github.ref_name }} to PyPI
+    runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      contents: read
+      id-token: write
+    defaults:
+      run:
+        working-directory: packages/introspection-aauth
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+
+      - name: The tag names the package's version
+        env:
+          TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          VERSION=$(uv version --short)
+          if [ "${TAG}" != "introspection-aauth-v${VERSION}" ]; then
+            echo "::error::${TAG} does not name pyproject.toml's version ${VERSION}"
+            exit 1
+          fi
+
+      - name: Run tests
+        run: |
+          uv sync --all-extras
+          uv run pytest tests/ -q
+
+      - name: Build package
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: packages/introspection-aauth/dist