diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 000000000..dfdb8b771
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.sh text eol=lf
diff --git a/.github/workflows/nuget-preview.yml b/.github/workflows/nuget-preview.yml
deleted file mode 100644
index d27382ad4..000000000
--- a/.github/workflows/nuget-preview.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: NuGet Preview Release
-
-on:
-  schedule:
-  - cron: "5 4 3 */1 *" # once a month, at 4:05 on 3rd
-  workflow_dispatch:
-
-jobs:
-  release:
-    name: Release Preview
-    runs-on: ubuntu-latest
-    environment: NuGet
-    timeout-minutes: 10
-
-    env:
-      PYTHONNET_SHUTDOWN_MODE: Normal
-
-    steps:
-      - name: Get Date
-        run: |
-          echo "DATE_VER=$(date "+%Y-%m-%d")" >> $GITHUB_ENV
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-
-      - name: Set up Python 3.8
-        uses: actions/setup-python@v5
-        with:
-          python-version: 3.8
-          architecture: x64
-
-      - name: Install dependencies
-        run: |
-          pip install --upgrade -r requirements.txt
-          pip install numpy # for tests
-
-      - name: Build and Install
-        run: |
-          pip install -v .
-
-      - name: Set Python DLL path (non Windows)
-        if: ${{ matrix.os != 'windows' }}
-        run: |
-          python -m pythonnet.find_libpython --export >> $GITHUB_ENV
-
-      - name: Python Tests
-        run: pytest
-
-      - name: Embedding tests
-        run: dotnet test --runtime any-ubuntu src/embed_tests/
-
-      - name: Pack
-        run: dotnet pack --configuration Release --version-suffix preview${{env.DATE_VER}} --output "Release-Preview"
-
-      - name: Publish NuGet
-        run: |
-          dotnet nuget push --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_MONTHLY }} Release-Preview/*.nupkg
-          dotnet nuget push --skip-duplicate --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_MONTHLY }} Release-Preview/*.snupkg
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 000000000..4d36e715e
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,33 @@
+name: Publish NuGet
+
+# Run manually to build the package with the version in Python.Runtime.csproj and push it to nuget.org
+on: workflow_dispatch
+
+jobs:
+  publish:
+    # Only publish what is merged, a pushed version can't be replaced
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # lets NuGet/login exchange the GitHub OIDC token for a short-lived nuget.org API key
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: 10.0.x
+
+      # The temporary API key expires after 1 hour, plenty for the build below
+      - name: NuGet login
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: Build and push
+        env:
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
+        run: ./build_push_nuget.sh
diff --git a/build_push_nuget.sh b/build_push_nuget.sh
new file mode 100755
index 000000000..889cb9742
--- /dev/null
+++ b/build_push_nuget.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Builds Python.Runtime, packs the QuantConnect.pythonnet NuGet and symbol packages into ./artifacts
+# with the <Version> in Python.Runtime.csproj and pushes them to nuget.org when NUGET_API_KEY is set
+#
+# Requires git and the .NET 10 SDK.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT="$ROOT/src/runtime/Python.Runtime.csproj"
+OUTPUT="$ROOT/artifacts"
+
+# Everything under pythonnet/ is packed as content, so drop stale build outputs and __pycache__ first
+git -C "$ROOT" clean -fdXq -- pythonnet
+
+echo "Packing NuGet package"
+rm -rf "$OUTPUT"
+dotnet pack "$PROJECT" --configuration Release --output "$OUTPUT"
+
+ls "$OUTPUT"
+
+if [[ -n "${NUGET_API_KEY:-}" ]]; then
+    echo "Pushing to nuget.org"
+    # Also pushes the .snupkg symbol package next to it
+    dotnet nuget push "$OUTPUT"/*.nupkg --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json
+fi
diff --git a/src/runtime/Python.Runtime.csproj b/src/runtime/Python.Runtime.csproj
index e290143d9..5eb146aed 100644
--- a/src/runtime/Python.Runtime.csproj
+++ b/src/runtime/Python.Runtime.csproj
@@ -35,7 +35,7 @@
         <PackagePath>contentFiles/any/any/</PackagePath>
         <PackageCopyToOutput>true</PackageCopyToOutput>
       </TfmSpecificPackageFile>
-      <TfmSpecificPackageFile Include="../../pythonnet/**">
+      <TfmSpecificPackageFile Include="../../pythonnet/**" Exclude="../../pythonnet/**/.*">
         <PackagePath>contentFiles/any/any/pythonnet</PackagePath>
         <PackageCopyToOutput>true</PackageCopyToOutput>
       </TfmSpecificPackageFile>