diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0c5cff4..8c8b352 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,7 @@
 name: CI
 
 # Build + test on every push/PR.
-# On a v* tag: publish NuGet to GitHub Packages AND publish npm package.
+# On a v* tag: publish NuGet to nuget.org (trusted publishing) and GitHub Packages, AND publish npm package.
 # On a js-v* tag: publish npm package only (JS-only patch releases).
 on:
   push:
@@ -72,10 +72,14 @@ jobs:
           TESTCONTAINERS_RYUK_DISABLED: "false"
 
   publish-nuget:
-    name: Pack & publish NuGet to GitHub Packages
+    name: Pack & publish NuGet (nuget.org + GitHub Packages)
     needs: dotnet-check
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write # nuget.org trusted publishing (OIDC): no stored API key
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-dotnet@v4
@@ -98,6 +102,17 @@ jobs:
             --source github \
             --api-key "${{ secrets.GITHUB_TOKEN }}" \
             --skip-duplicate
+      - name: Log in to nuget.org (trusted publishing)
+        id: nuget-login
+        uses: NuGet/login@v1
+        with:
+          user: rvegajr
+      - name: Push to nuget.org
+        run: |
+          dotnet nuget push "artifacts/nuget/*.nupkg" \
+            --source https://api.nuget.org/v3/index.json \
+            --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" \
+            --skip-duplicate
       - uses: actions/upload-artifact@v4
         with:
           name: nuget-packages
diff --git a/Directory.Build.props b/Directory.Build.props
index dbc8710..711af9a 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -13,7 +13,7 @@
     <EzEngineTfm>netstandard2.0</EzEngineTfm>
     <EzPlatformTfm>net10.0</EzPlatformTfm>
     <!-- NuGet metadata for the embeddable packages (spec 15 §2) -->
-    <Version>1.0.4</Version>
+    <Version>1.0.5</Version>
     <Authors>Noctusoft, Inc.</Authors>
     <Company>Noctusoft, Inc.</Company>
     <Copyright>Copyright © 2026 Noctusoft, Inc.</Copyright>
diff --git a/js/package.json b/js/package.json
index 6e242dd..c4cc25f 100644
--- a/js/package.json
+++ b/js/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@noctusoft/ezodata-express",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Bolt a governed OData v4 + REST + MCP API onto any Express app. Pure TypeScript, full parity with the ez-odata .NET engine.",
   "license": "Apache-2.0",
   "author": "Noctusoft, Inc.",