diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..d6736d8b
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,83 @@
+name: Publish VSIX to VSCode & Open VSX (Manual)
+
+# This workflow:
+# - Is manually triggered from GitHub Actions tab
+# - Downloads the .vsix from the specified release tag
+# - Publishes it to:
+#     • Visual Studio Marketplace (via vsce)
+#     • Open VSX Registry (via ovsx)
+# - Supports dry run mode (no actual publish unless dry_run == false)
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'GitHub release tag to publish (e.g., v1.2.3)'
+        required: true
+        type: string
+      dry_run:
+        description: 'Dry run (do not publish)?'
+        required: false
+        default: 'true'
+        type: boolean
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Validate release tag and download .vsix
+        run: |
+          echo "🔎 Validating release tag '${{ github.event.inputs.tag }}'"
+
+          if ! gh release view ${{ github.event.inputs.tag }} > /dev/null 2>&1; then
+            echo "❌ Release tag '${{ github.event.inputs.tag }}' not found."
+            exit 1
+          fi
+
+          gh release download ${{ github.event.inputs.tag }} \
+            --pattern "*.vsix" \
+            --dir ./
+
+          if ! ls ./*.vsix 1> /dev/null 2>&1; then
+            echo "❌ No .vsix file found in release '${{ github.event.inputs.tag }}'."
+            exit 1
+          fi
+
+          echo "✅ .vsix file downloaded:"
+          ls -lh *.vsix
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install @vscode/vsce and ovsx (latest)
+        run: yarn global add @vscode/vsce ovsx
+
+      - name: Publish to VSCode Marketplace
+        run: |
+          echo "▶️ vsce publish --packagePath *.vsix"
+          if [ "${{ github.event.inputs.dry_run }}" = "false" ]; then
+            vsce publish --packagePath *.vsix
+          else
+            echo "🟡 dry run enabled: skipping publish to VSCode Marketplace"
+          fi
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+
+      - name: Publish to Open VSX
+        run: |
+          echo "▶️ ovsx publish *.vsix"
+          if [ "${{ github.event.inputs.dry_run }}" = "false" ]; then
+            ovsx publish *.vsix
+          else
+            echo "🟡 dry run enabled: skipping publish to Open VSX"
+          fi
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}