diff --git a/.github/workflows/publish-github-packages.yml b/.github/workflows/publish-github-packages.yml
new file mode 100644
index 0000000..d51428b
--- /dev/null
+++ b/.github/workflows/publish-github-packages.yml
@@ -0,0 +1,42 @@
+name: Publish to GitHub Packages
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  JAVA_OPTS: -Dfile.encoding=UTF-8
+
+jobs:
+  publish:
+    # Only runs when the fork/repo has configured PUBLISH_PACKAGES_REPO as a repo variable.
+    # Upstream does not set this, so this job is a no-op there.
+    if: vars.PUBLISH_PACKAGES_REPO != ''
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        fetch-depth: 0  # needed for sbt-dynver
+
+    - name: Setup JDK
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        distribution: temurin
+        java-version: 21
+        cache: sbt
+    - uses: sbt/setup-sbt@dd1ef7d7798fab5ce802a6adab3b782817b8c2d0 # v1
+
+    - name: Publish
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        PUBLISH_PACKAGES_REPO: ${{ vars.PUBLISH_PACKAGES_REPO }}
+        PUBLISH_ORG: ${{ vars.PUBLISH_ORG }}
+        PUBLISH_ORG_NAME: ${{ vars.PUBLISH_ORG_NAME }}
+      run: sbt -v "core/publish; postgres/publish"
diff --git a/.gitignore b/.gitignore
index bc9b128..053ce8e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,6 +14,7 @@ project/local-plugins.sbt
 .ensime_cache/
 .sbt-scripted/
 local.sbt
+build.sbt.semanticdb
 
 # Bloop
 .bsp
diff --git a/build.sbt b/build.sbt
index 3fcbd64..ae15e85 100644
--- a/build.sbt
+++ b/build.sbt
@@ -4,8 +4,8 @@ val zioVersion    = "2.1.24"
 
 ThisBuild / dependencyOverrides += "org.scalameta" % "semanticdb-scalac_2.12.21" % "4.14.4"
 ThisBuild / scalaVersion                          := scala3Version
-ThisBuild / organization                          := "io.github.russwyte"
-ThisBuild / organizationName                      := "russwyte"
+ThisBuild / organization                          := sys.env.getOrElse("PUBLISH_ORG", "io.github.russwyte")
+ThisBuild / organizationName                      := sys.env.getOrElse("PUBLISH_ORG_NAME", "russwyte")
 ThisBuild / organizationHomepage                  := Some(url("https://github.com/russwyte"))
 ThisBuild / licenses := List("Apache-2.0" -> url("http://www.apache.org/licenses/LICENSE-2.0.txt"))
 ThisBuild / homepage := Some(url("https://github.com/russwyte/mechanoid"))
@@ -25,7 +25,22 @@ ThisBuild / developers := List(
 )
 ThisBuild / versionScheme          := Some("early-semver")
 
-usePgpKeyHex("2F64727A87F1BCF42FD307DD8582C4F16659A7D6")
+// --- Fork publishing support (GitHub Packages) ---
+// Forks set PUBLISH_PACKAGES_REPO and GITHUB_TOKEN in CI to publish to their own GitHub Packages.
+// Optionally set PUBLISH_ORG and PUBLISH_ORG_NAME to change the Maven group ID.
+val githubPackagesRepo: Option[MavenRepository] =
+  sys.env.get("PUBLISH_PACKAGES_REPO").map("GitHub Packages" at _)
+
+ThisBuild / credentials ++= sys.env.get("GITHUB_TOKEN").map { token =>
+  Credentials("GitHub Package Registry", "maven.pkg.github.com", "_", token)
+}.toSeq
+
+ThisBuild / resolvers ++= githubPackagesRepo.toSeq
+
+// PGP signing: only when publishing to Maven Central (forks targeting GitHub Packages won't have the key)
+githubPackagesRepo match
+  case None    => usePgpKeyHex("2F64727A87F1BCF42FD307DD8582C4F16659A7D6")
+  case Some(_) => Seq.empty
 
 ThisBuild / libraryDependencies ++= Seq(
   "dev.zio" %% "zio"                      % zioVersion % "provided",
@@ -52,7 +67,7 @@ lazy val commonSettings = Seq(
 lazy val publishSettings = Seq(
   publishMavenStyle    := true,
   pomIncludeRepository := { _ => false },
-  publishTo            := localStaging.value,
+  publishTo            := githubPackagesRepo.map(r => r: Resolver).orElse(localStaging.value),
 )
 
 lazy val root = project