diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7e010cb66..8dd16dff0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,10 +4,21 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: 'Dry run (no actual publish)'
+        type: boolean
+        default: true
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # for npm provenance
+    env:
+      NPM_PUBLISHABLE_PROJECTS: chat,langgraph,ag-ui,render,a2ui,partial-json,licensing,mcp
     steps:
       - uses: actions/checkout@v6.0.2
       - uses: actions/setup-node@v6.3.0
@@ -15,11 +26,21 @@ jobs:
           node-version: 22
           cache: npm
           registry-url: https://registry.npmjs.org
+
       - run: npm ci
-      - run: npx nx test mcp --skip-nx-cache
-      - run: npx nx test langgraph
-      - run: npx nx build langgraph --configuration=production
+
+      - name: Lint, test, build publishable projects
+        run: npx nx run-many -t lint,test,build --projects=$NPM_PUBLISHABLE_PROJECTS --skip-nx-cache
+
       - name: Publish to npm
-        run: npx nx-release-publish agent
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry-run == false)
+        run: npx nx release publish --groups=publishable
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'
+
+      - name: Publish to npm (dry run)
+        if: github.event_name == 'workflow_dispatch' && inputs.dry-run == true
+        run: npx nx release publish --groups=publishable --dry-run
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/libs/cockpit-docs/package.json b/libs/cockpit-docs/package.json
index 5a3cc0790..4141e7024 100644
--- a/libs/cockpit-docs/package.json
+++ b/libs/cockpit-docs/package.json
@@ -11,5 +11,6 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "private": true
 }
diff --git a/libs/cockpit-registry/package.json b/libs/cockpit-registry/package.json
index 0dd90749c..d166607a5 100644
--- a/libs/cockpit-registry/package.json
+++ b/libs/cockpit-registry/package.json
@@ -11,5 +11,6 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "private": true
 }
diff --git a/libs/cockpit-shell/package.json b/libs/cockpit-shell/package.json
index 25d146ea1..0ac1dcf49 100644
--- a/libs/cockpit-shell/package.json
+++ b/libs/cockpit-shell/package.json
@@ -11,5 +11,6 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "private": true
 }
diff --git a/libs/cockpit-testing/package.json b/libs/cockpit-testing/package.json
index 6a6230159..03988c429 100644
--- a/libs/cockpit-testing/package.json
+++ b/libs/cockpit-testing/package.json
@@ -11,5 +11,6 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "private": true
 }
diff --git a/libs/cockpit-ui/package.json b/libs/cockpit-ui/package.json
index 1d7504038..41266bba3 100644
--- a/libs/cockpit-ui/package.json
+++ b/libs/cockpit-ui/package.json
@@ -11,5 +11,6 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "private": true
 }
diff --git a/libs/db/package.json b/libs/db/package.json
index 6490d8a5c..6bf6fbb24 100644
--- a/libs/db/package.json
+++ b/libs/db/package.json
@@ -19,5 +19,6 @@
   "peerDependencies": {
     "drizzle-orm": "^0.45.0",
     "postgres": "^3.4.0"
-  }
+  },
+  "private": true
 }
diff --git a/libs/design-tokens/package.json b/libs/design-tokens/package.json
index d4586a9f1..19985d1cf 100644
--- a/libs/design-tokens/package.json
+++ b/libs/design-tokens/package.json
@@ -11,5 +11,6 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "private": true
 }
diff --git a/libs/example-layouts/package.json b/libs/example-layouts/package.json
index 93f005ee3..bd5056601 100644
--- a/libs/example-layouts/package.json
+++ b/libs/example-layouts/package.json
@@ -15,5 +15,6 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "private": true
 }
diff --git a/libs/ui-react/package.json b/libs/ui-react/package.json
index 9b2ac463f..513f62c29 100644
--- a/libs/ui-react/package.json
+++ b/libs/ui-react/package.json
@@ -15,5 +15,6 @@
   "peerDependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
-  }
+  },
+  "private": true
 }
diff --git a/nx.json b/nx.json
index 7d131ad75..973ac4acd 100644
--- a/nx.json
+++ b/nx.json
@@ -42,8 +42,23 @@
     }
   },
   "release": {
+    "groups": {
+      "publishable": {
+        "projects": [
+          "chat",
+          "langgraph",
+          "ag-ui",
+          "render",
+          "a2ui",
+          "partial-json",
+          "licensing",
+          "mcp"
+        ],
+        "projectsRelationship": "independent"
+      }
+    },
     "version": {
-      "preVersionCommand": "npx nx run-many -t build"
+      "preVersionCommand": "npx nx run-many -t build --projects=chat,langgraph,ag-ui,render,a2ui,partial-json,licensing,mcp"
     }
   },
   "generators": {