diff --git a/Cargo.lock b/Cargo.lock
index 0678af98d0..c5c7b3388f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6033,8 +6033,11 @@ dependencies = [
  "pixi_uv_conversions",
  "rattler",
  "rattler_conda_types",
+ "rattler_index",
  "rattler_lock",
  "rattler_networking",
+ "rattler_package_streaming",
+ "rattler_s3",
  "rattler_shell",
  "rattler_solve",
  "rattler_upload",
diff --git a/Cargo.toml b/Cargo.toml
index 97b372fd9a..74e5466800 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -226,6 +226,9 @@ rattler_conda_types = { version = "0.44.0", default-features = false, features =
   "rayon",
 ] }
 rattler_digest = { version = "1.2.2", default-features = false }
+rattler_index = { version = "0.27.17", default-features = false, features = [
+  "s3",
+] }
 rattler_lock = { version = "0.27.0", default-features = false }
 rattler_menuinst = { version = "0.2.49", default-features = false }
 rattler_networking = { version = "0.26.2", default-features = false, features = [
@@ -234,6 +237,7 @@ rattler_networking = { version = "0.26.2", default-features = false, features =
 ] }
 rattler_package_streaming = { version = "0.24.2", default-features = false }
 rattler_repodata_gateway = { version = "0.27.0", default-features = false }
+rattler_s3 = { version = "0.1.26", default-features = false }
 rattler_shell = { version = "0.26.2", default-features = false }
 rattler_solve = { version = "5.0.0", default-features = false }
 rattler_upload = { version = "0.5.0", default-features = false, features = [
diff --git a/crates/pixi_cli/Cargo.toml b/crates/pixi_cli/Cargo.toml
index 308fac2c11..ec33571278 100644
--- a/crates/pixi_cli/Cargo.toml
+++ b/crates/pixi_cli/Cargo.toml
@@ -67,6 +67,9 @@ rattler_lock = { workspace = true }
 rattler_networking = { workspace = true, default-features = false }
 rattler_shell = { workspace = true, features = ["sysinfo"] }
 rattler_solve = { workspace = true, features = ["resolvo", "serde"] }
+rattler_index = { workspace = true }
+rattler_package_streaming = { workspace = true }
+rattler_s3 = { workspace = true }
 rattler_upload = { workspace = true }
 rattler_virtual_packages = { workspace = true }
 regex = { workspace = true }
diff --git a/crates/pixi_cli/src/build.rs b/crates/pixi_cli/src/build.rs
index b6a5a174ae..a3db45f103 100644
--- a/crates/pixi_cli/src/build.rs
+++ b/crates/pixi_cli/src/build.rs
@@ -71,7 +71,7 @@ pub struct Args {
 
 /// Validate that the full path of package manifest exists and is a supported format.
 /// Directories are allowed (for discovery), and specific manifest files must be supported formats.
-async fn validate_package_manifest(path: &PathBuf) -> miette::Result<()> {
+pub(crate) async fn validate_package_manifest(path: &PathBuf) -> miette::Result<()> {
     let supported_file_names: Vec<&str> = [
         // backend-specific build files
         // that will be autodiscovered
diff --git a/crates/pixi_cli/src/lib.rs b/crates/pixi_cli/src/lib.rs
index 5999b8eedc..ce3b60216e 100644
--- a/crates/pixi_cli/src/lib.rs
+++ b/crates/pixi_cli/src/lib.rs
@@ -37,6 +37,7 @@ pub mod install;
 pub mod list;
 pub mod lock;
 pub(crate) mod match_spec_or_path;
+pub mod publish;
 pub mod reinstall;
 pub mod remove;
 pub mod run;
@@ -172,6 +173,7 @@ pub enum Command {
     List(list::Args),
     Lock(lock::Args),
     Reinstall(reinstall::Args),
+    Publish(publish::Args),
     #[clap(visible_alias = "rm")]
     Remove(remove::Args),
     #[clap(visible_alias = "r")]
@@ -367,6 +369,7 @@ pub async fn execute_command(
         Command::Task(cmd) => task::execute(cmd).await,
         Command::Info(cmd) => info::execute(cmd).await,
         Command::Import(cmd) => import::execute(cmd).await,
+        Command::Publish(cmd) => publish::execute(cmd).await,
         Command::Upload(cmd) => upload::execute(cmd).await,
         Command::Search(cmd) => search::execute(cmd).await,
         Command::Workspace(cmd) => workspace::execute(cmd).await,
diff --git a/crates/pixi_cli/src/publish.rs b/crates/pixi_cli/src/publish.rs
new file mode 100644
index 0000000000..2c253c777f
--- /dev/null
+++ b/crates/pixi_cli/src/publish.rs
@@ -0,0 +1,687 @@
+use std::path::PathBuf;
+
+use clap::Parser;
+use indicatif::ProgressBar;
+use miette::{Context, IntoDiagnostic};
+use pixi_auth::get_auth_store;
+use pixi_build_frontend::BackendOverride;
+use pixi_command_dispatcher::{
+    BuildBackendMetadataSpec, BuildEnvironment, BuildProfile, CacheDirs, SourceBuildSpec,
+    build::PinnedSourceCodeLocation,
+};
+use pixi_config::{Config, ConfigCli};
+use pixi_core::{WorkspaceLocator, environment::sanity_check_workspace};
+use pixi_manifest::FeaturesExt;
+use pixi_path::AbsPathBuf;
+use pixi_progress::global_multi_progress;
+use pixi_record::{PinnedPathSpec, PinnedSourceSpec};
+use pixi_reporters::TopLevelProgress;
+use pixi_utils::variants::VariantConfig;
+use rattler_conda_types::{GenericVirtualPackage, Platform};
+use rattler_networking::AuthenticationStorage;
+use rattler_package_streaming::seek::read_package_file;
+
+use crate::build::{determine_discovery_start, validate_package_manifest};
+use crate::cli_config::LockAndInstallConfig;
+
+/// Build a conda package and publish it to a channel.
+///
+/// This is a convenience command that combines `pixi build` and `pixi upload`.
+///
+/// Supported target channel URLs:
+///   - prefix.dev: `https://prefix.dev/<channel-name>`
+///   - anaconda.org: `https://anaconda.org/<owner>/<label>`
+///   - S3: `s3://bucket-name`
+///   - Filesystem: `file:///path/to/channel`
+///   - Quetz: `quetz://server/<channel>`
+///   - Artifactory: `artifactory://server/<channel>`
+#[derive(Parser, Debug)]
+#[clap(verbatim_doc_comment)]
+pub struct Args {
+    #[clap(flatten)]
+    pub config_cli: ConfigCli,
+
+    /// Backend override for testing purposes.
+    #[clap(skip)]
+    pub backend_override: Option<BackendOverride>,
+
+    #[clap(flatten)]
+    pub lock_and_install_config: LockAndInstallConfig,
+
+    /// The target platform to build for (defaults to the current platform)
+    #[clap(long, short, default_value_t = Platform::current())]
+    pub target_platform: Platform,
+
+    /// The build platform to use for building (defaults to the current platform)
+    #[clap(long, default_value_t = Platform::current())]
+    pub build_platform: Platform,
+
+    /// The directory to use for incremental builds artifacts.
+    #[clap(long, short)]
+    pub build_dir: Option<PathBuf>,
+
+    /// Whether to clean the build directory before building.
+    #[clap(long, short)]
+    pub clean: bool,
+
+    /// The path to a directory containing a package manifest, or to a specific manifest file.
+    ///
+    /// Supported manifest files: `package.xml`, `recipe.yaml`, `pixi.toml`, `pyproject.toml`, or `mojoproject.toml`.
+    #[arg(long)]
+    pub path: Option<PathBuf>,
+
+    /// The target channel URL to publish packages to.
+    ///
+    /// Examples:
+    ///   --to <https://prefix.dev/my-channel>
+    ///   --to <https://anaconda.org/my-user>
+    ///   --to s3://my-bucket/my-channel
+    ///   --to file:///path/to/local/channel
+    #[arg(long)]
+    pub to: String,
+
+    /// Force overwrite existing packages
+    #[arg(long)]
+    pub force: bool,
+
+    /// Skip uploading packages that already exist on the target channel.
+    /// This is enabled by default. Use `--no-skip-existing` to disable.
+    #[arg(long, default_value_t = true, action = clap::ArgAction::Set)]
+    pub skip_existing: bool,
+
+    /// Generate sigstore attestation (prefix.dev only)
+    #[arg(long)]
+    pub generate_attestation: bool,
+}
+
+pub async fn execute(args: Args) -> miette::Result<()> {
+    // === Phase 1: Build the packages (same logic as `pixi build`) ===
+
+    let workspace_locator = determine_discovery_start(&args.path).await?;
+
+    let workspace = WorkspaceLocator::for_cli()
+        .with_search_start(workspace_locator.clone())
+        .with_closest_package(false)
+        .locate()?
+        .with_cli_config(args.config_cli);
+
+    sanity_check_workspace(&workspace).await?;
+
+    let multi_progress = global_multi_progress();
+    let anchor_pb = multi_progress.add(ProgressBar::hidden());
+    let cache_dir = AbsPathBuf::new(pixi_config::get_cache_dir()?)
+        .expect("cache dir is not absolute")
+        .into_assume_dir();
+    let workspace_dir = AbsPathBuf::new(workspace.pixi_dir())
+        .expect("pixi dir is not absolute")
+        .into_assume_dir();
+    let mut cache_dirs = CacheDirs::new(cache_dir).with_workspace(workspace_dir);
+    if let Some(build_dir) = args.build_dir {
+        let build_dir = AbsPathBuf::new(build_dir)
+            .expect("build dir is not absolute")
+            .into_assume_dir();
+        cache_dirs.set_working_dirs(build_dir);
+    }
+    let command_dispatcher = workspace
+        .command_dispatcher_builder()?
+        .with_cache_dirs(cache_dirs)
+        .with_reporter(TopLevelProgress::new(multi_progress, anchor_pb))
+        .finish();
+
+    let VariantConfig {
+        variant_configuration,
+        variant_files,
+    } = workspace.variants(args.target_platform)?;
+
+    let build_virtual_packages: Vec<GenericVirtualPackage> = workspace
+        .default_environment()
+        .virtual_packages(args.build_platform)
+        .into_iter()
+        .map(GenericVirtualPackage::from)
+        .collect();
+
+    let host_virtual_packages: Vec<GenericVirtualPackage> = workspace
+        .default_environment()
+        .virtual_packages(args.target_platform)
+        .into_iter()
+        .map(GenericVirtualPackage::from)
+        .collect();
+
+    let build_environment = BuildEnvironment {
+        host_platform: args.target_platform,
+        build_platform: args.build_platform,
+        build_virtual_packages,
+        host_virtual_packages,
+    };
+
+    let Ok(manifest_path) = workspace_locator.path() else {
+        miette::bail!("could not determine the current working directory to locate the workspace");
+    };
+
+    let package_manifest_path = match args.path {
+        Some(path) => {
+            validate_package_manifest(&path).await?;
+            path
+        }
+        None => manifest_path.clone(),
+    };
+
+    let package_manifest_path_canonical = dunce::canonicalize(&package_manifest_path)
+        .into_diagnostic()
+        .with_context(|| {
+            format!(
+                "failed to canonicalize manifest path '{}'",
+                package_manifest_path.display()
+            )
+        })?;
+
+    let manifest_path_spec =
+        pathdiff::diff_paths(&package_manifest_path_canonical, workspace.root())
+            .unwrap_or_else(|| package_manifest_path_canonical.to_path_buf());
+
+    let channel_config = workspace.channel_config();
+    let channels = workspace
+        .default_environment()
+        .channel_urls(&channel_config)
+        .into_diagnostic()?;
+
+    let manifest_source: PinnedSourceSpec = PinnedPathSpec {
+        path: manifest_path_spec.to_string_lossy().into_owned().into(),
+    }
+    .into();
+
+    let backend_metadata_spec = BuildBackendMetadataSpec {
+        manifest_source: manifest_source.clone(),
+        preferred_build_source: None,
+        channels: channels.clone(),
+        channel_config: channel_config.clone(),
+        build_environment: build_environment.clone(),
+        variant_configuration: Some(variant_configuration.clone()),
+        variant_files: Some(variant_files.clone()),
+        enabled_protocols: Default::default(),
+    };
+    let backend_metadata = command_dispatcher
+        .build_backend_metadata(backend_metadata_spec.clone())
+        .await?;
+
+    let packages = backend_metadata.metadata.outputs();
+
+    // Print initial build summary
+    pixi_progress::println!(
+        "\n{}Building {} package(s):",
+        console::style(console::Emoji("📋 ", "")).cyan(),
+        packages.len()
+    );
+    for pkg in &packages {
+        pixi_progress::println!(
+            "  - {} v{} [{}] ({})",
+            pkg.name.as_normalized(),
+            pkg.version,
+            pkg.build,
+            pkg.subdir
+        );
+    }
+    pixi_progress::println!("");
+
+    // Build and collect all package paths
+    let mut built_package_paths: Vec<PathBuf> = Vec::new();
+
+    for package in packages {
+        let built_package = command_dispatcher
+            .source_build(SourceBuildSpec {
+                package,
+                output_directory: None,
+                source: PinnedSourceCodeLocation::new(manifest_source.clone(), None),
+                channels: channels.clone(),
+                channel_config: channel_config.clone(),
+                build_environment: build_environment.clone(),
+                variant_configuration: Some(variant_configuration.clone()),
+                variant_files: Some(variant_files.clone()),
+                variants: None,
+                enabled_protocols: Default::default(),
+                work_directory: None,
+                clean: args.clean,
+                force: false,
+                build_profile: BuildProfile::Release,
+            })
+            .await?;
+
+        command_dispatcher.clear_reporter().await;
+
+        let package_path = dunce::canonicalize(&built_package.output_file)
+            .expect("failed to canonicalize output file which must now exist");
+
+        built_package_paths.push(package_path);
+    }
+
+    if built_package_paths.is_empty() {
+        miette::bail!("No packages were built. Nothing to publish.");
+    }
+
+    // === Phase 2: Upload the built packages ===
+
+    pixi_progress::println!(
+        "\n{}Publishing {} package(s) to {}",
+        console::style(console::Emoji("📦 ", "")).cyan(),
+        built_package_paths.len(),
+        args.to
+    );
+
+    let config = Config::load_global();
+    let auth_storage = get_auth_store(&config).into_diagnostic()?;
+
+    let target_url = parse_target_url(&args.to)?;
+
+    pixi_progress::await_in_progress("uploading packages", |_| {
+        upload_packages(
+            &target_url,
+            &built_package_paths,
+            &auth_storage,
+            args.force,
+            args.skip_existing,
+            args.generate_attestation,
+        )
+    })
+    .await?;
+
+    pixi_progress::println!(
+        "{}Successfully published {} package(s) to {}",
+        console::style(console::Emoji("✔ ", "")).green(),
+        built_package_paths.len(),
+        args.to
+    );
+    for path in &built_package_paths {
+        let name = path
+            .file_name()
+            .map(|n| n.to_string_lossy())
+            .unwrap_or_default();
+        pixi_progress::println!("  - {}", name);
+    }
+
+    Ok(())
+}
+
+/// Parse a target URL string into a URL, handling various schemes.
+fn parse_target_url(to: &str) -> miette::Result<url::Url> {
+    url::Url::parse(to).map_err(|e| miette::miette!("Invalid target URL '{}': {}", to, e))
+}
+
+/// Determine the subdirectory (platform) of a conda package.
+fn determine_package_subdir(package_path: &std::path::Path) -> miette::Result<String> {
+    let index_json: rattler_conda_types::package::IndexJson = read_package_file(package_path)
+        .map_err(|e| miette::miette!("Failed to read package file: {}", e))?;
+
+    Ok(index_json.subdir.unwrap_or_else(|| "noarch".to_string()))
+}
+
+/// Upload packages to the target channel based on the URL scheme/host.
+///
+/// This logic is adapted from `rattler_build_core::publish::upload_and_index_channel`.
+async fn upload_packages(
+    url: &url::Url,
+    package_paths: &[PathBuf],
+    auth_storage: &AuthenticationStorage,
+    force: bool,
+    skip_existing: bool,
+    generate_attestation: bool,
+) -> miette::Result<()> {
+    let scheme = url.scheme();
+
+    match scheme {
+        "s3" => upload_to_s3(url, package_paths, auth_storage, force).await,
+        "quetz" => upload_to_quetz(url, package_paths, auth_storage).await,
+        "artifactory" => upload_to_artifactory(url, package_paths, auth_storage).await,
+        "prefix" => {
+            upload_to_prefix(
+                url,
+                package_paths,
+                auth_storage,
+                force,
+                skip_existing,
+                generate_attestation,
+            )
+            .await
+        }
+        "file" => {
+            let path = url
+                .to_file_path()
+                .map_err(|()| miette::miette!("Invalid file URL: {}", url))?;
+            upload_to_local_filesystem(&path, package_paths, force, skip_existing).await
+        }
+        "http" | "https" => {
+            let host = url.host_str().unwrap_or("");
+
+            if host.contains("prefix.dev") {
+                upload_to_prefix(
+                    url,
+                    package_paths,
+                    auth_storage,
+                    force,
+                    skip_existing,
+                    generate_attestation,
+                )
+                .await
+            } else if host.contains("anaconda.org") {
+                upload_to_anaconda(url, package_paths, auth_storage, force).await
+            } else if host.contains("quetz") {
+                upload_to_quetz(url, package_paths, auth_storage).await
+            } else {
+                Err(miette::miette!(
+                    "Cannot determine upload backend from URL '{}'. \n\
+                    Supported hosts: prefix.dev, anaconda.org, or use explicit schemes: s3://, quetz://, artifactory://, prefix://",
+                    url
+                ))
+            }
+        }
+        _ => Err(miette::miette!(
+            "Unsupported URL scheme '{}'. Supported schemes: file://, s3://, quetz://, artifactory://, prefix://, http://, https://",
+            scheme
+        )),
+    }
+}
+
+/// Upload packages to a Prefix.dev server.
+async fn upload_to_prefix(
+    url: &url::Url,
+    package_paths: &[PathBuf],
+    auth_storage: &AuthenticationStorage,
+    force: bool,
+    skip_existing: bool,
+    generate_attestation: bool,
+) -> miette::Result<()> {
+    use rattler_upload::upload::opt::{
+        AttestationSource, ForceOverwrite, PrefixData, SkipExisting,
+    };
+    use rattler_upload::upload::upload_package_to_prefix;
+
+    tracing::info!("Uploading packages to Prefix.dev: {}", url);
+
+    let channel = url
+        .path_segments()
+        .and_then(|mut segments| segments.next_back())
+        .ok_or_else(|| miette::miette!("Invalid Prefix URL: missing channel name"))?
+        .to_string();
+
+    let mut server_url = url.clone();
+    if server_url.scheme() == "prefix" {
+        server_url
+            .set_scheme("https")
+            .map_err(|_| miette::miette!("Failed to convert prefix:// URL to https://"))?;
+    }
+    server_url.set_path("");
+
+    let attestation = if generate_attestation {
+        AttestationSource::GenerateAttestation
+    } else {
+        AttestationSource::NoAttestation
+    };
+
+    let prefix_data = PrefixData::new(
+        server_url,
+        channel,
+        None,
+        attestation,
+        SkipExisting(skip_existing),
+        ForceOverwrite(force),
+        false,
+    );
+
+    upload_package_to_prefix(auth_storage, &package_paths.to_vec(), prefix_data)
+        .await
+        .into_diagnostic()
+}
+
+/// Upload packages to Anaconda.org.
+async fn upload_to_anaconda(
+    url: &url::Url,
+    package_paths: &[PathBuf],
+    auth_storage: &AuthenticationStorage,
+    force: bool,
+) -> miette::Result<()> {
+    use rattler_upload::upload::opt::{AnacondaData, ForceOverwrite};
+    use rattler_upload::upload::upload_package_to_anaconda;
+
+    tracing::info!("Uploading packages to Anaconda.org: {}", url);
+
+    let path_segments: Vec<&str> = url
+        .path_segments()
+        .ok_or_else(|| miette::miette!("Invalid Anaconda.org URL: missing path"))?
+        .collect();
+
+    let (owner, channel) = match path_segments.len() {
+        1 => (path_segments[0].to_string(), "main".to_string()),
+        2 => (path_segments[0].to_string(), path_segments[1].to_string()),
+        _ => {
+            return Err(miette::miette!(
+                "Invalid Anaconda.org URL format. Expected: https://anaconda.org/owner or https://anaconda.org/owner/label"
+            ));
+        }
+    };
+
+    let anaconda_data = AnacondaData::new(
+        owner,
+        Some(vec![channel]),
+        None,
+        None,
+        ForceOverwrite(force),
+    );
+
+    upload_package_to_anaconda(auth_storage, &package_paths.to_vec(), anaconda_data)
+        .await
+        .into_diagnostic()
+}
+
+/// Upload packages to a Quetz server.
+async fn upload_to_quetz(
+    url: &url::Url,
+    package_paths: &[PathBuf],
+    auth_storage: &AuthenticationStorage,
+) -> miette::Result<()> {
+    use rattler_upload::upload::opt::QuetzData;
+    use rattler_upload::upload::upload_package_to_quetz;
+
+    tracing::info!("Uploading packages to Quetz: {}", url);
+
+    let channel = url
+        .path_segments()
+        .and_then(|mut segments| segments.next_back())
+        .ok_or_else(|| miette::miette!("Invalid Quetz URL: missing channel name"))?
+        .to_string();
+
+    let mut server_url = url.clone();
+    if server_url.scheme() == "quetz" {
+        server_url
+            .set_scheme("https")
+            .map_err(|_| miette::miette!("Failed to convert quetz:// URL to https://"))?;
+    }
+    server_url.set_path("");
+
+    let quetz_data = QuetzData::new(server_url, channel, None);
+
+    upload_package_to_quetz(auth_storage, &package_paths.to_vec(), quetz_data).await
+}
+
+/// Upload packages to an Artifactory server.
+async fn upload_to_artifactory(
+    url: &url::Url,
+    package_paths: &[PathBuf],
+    auth_storage: &AuthenticationStorage,
+) -> miette::Result<()> {
+    use rattler_upload::upload::opt::ArtifactoryData;
+    use rattler_upload::upload::upload_package_to_artifactory;
+
+    tracing::info!("Uploading packages to Artifactory: {}", url);
+
+    let channel = url
+        .path_segments()
+        .and_then(|mut segments| segments.next_back())
+        .ok_or_else(|| miette::miette!("Invalid Artifactory URL: missing repository name"))?
+        .to_string();
+
+    let mut server_url = url.clone();
+    if server_url.scheme() == "artifactory" {
+        server_url
+            .set_scheme("https")
+            .map_err(|_| miette::miette!("Failed to convert artifactory:// URL to https://"))?;
+    }
+    server_url.set_path("");
+
+    let artifactory_data = ArtifactoryData::new(server_url, channel, None);
+
+    upload_package_to_artifactory(auth_storage, &package_paths.to_vec(), artifactory_data).await
+}
+
+/// Upload packages to S3 and run indexing.
+async fn upload_to_s3(
+    url: &url::Url,
+    package_paths: &[PathBuf],
+    auth_storage: &AuthenticationStorage,
+    force: bool,
+) -> miette::Result<()> {
+    use rattler_index::{IndexS3Config, ensure_channel_initialized_s3, index_s3};
+    use rattler_upload::upload::upload_package_to_s3;
+    use std::collections::HashSet;
+
+    tracing::info!("Uploading packages to S3: {}", url);
+
+    // Resolve S3 credentials using AWS SDK default credential chain
+    let resolved_credentials = rattler_s3::ResolvedS3Credentials::from_sdk()
+        .await
+        .map_err(|e| miette::miette!("Failed to resolve S3 credentials: {}", e))?;
+
+    ensure_channel_initialized_s3(url, &resolved_credentials)
+        .await
+        .map_err(|e| miette::miette!("Failed to initialize S3 channel: {}", e))?;
+
+    let mut subdirs = HashSet::new();
+    for package_path in package_paths {
+        let subdir = determine_package_subdir(package_path)?;
+        subdirs.insert(subdir);
+    }
+
+    upload_package_to_s3(
+        auth_storage,
+        url.clone(),
+        None,
+        &package_paths.to_vec(),
+        force,
+    )
+    .await?;
+
+    tracing::info!("Successfully uploaded packages to S3, running indexing...");
+
+    for subdir in subdirs {
+        let target_platform = subdir
+            .parse::<Platform>()
+            .map_err(|e| miette::miette!("Invalid platform subdir '{}': {}", subdir, e))?;
+
+        let index_config = IndexS3Config {
+            channel: url.clone(),
+            credentials: resolved_credentials.clone(),
+            target_platform: Some(target_platform),
+            repodata_patch: None,
+            write_zst: true,
+            write_shards: true,
+            force: false,
+            max_parallel: std::thread::available_parallelism()
+                .map(|p| p.get())
+                .unwrap_or(1),
+            multi_progress: None,
+            precondition_checks: rattler_index::PreconditionChecks::Enabled,
+        };
+
+        index_s3(index_config)
+            .await
+            .map_err(|e| miette::miette!("Failed to index S3 channel: {}", e))?;
+    }
+
+    Ok(())
+}
+
+/// Upload packages to local filesystem and run indexing.
+async fn upload_to_local_filesystem(
+    target_dir: &std::path::Path,
+    package_paths: &[PathBuf],
+    force: bool,
+    skip_existing: bool,
+) -> miette::Result<()> {
+    use rattler_index::{IndexFsConfig, ensure_channel_initialized_fs, index_fs};
+    use std::collections::HashSet;
+
+    tracing::info!(
+        "Publishing packages to local channel: {}",
+        target_dir.display()
+    );
+
+    fs_err::create_dir_all(target_dir).into_diagnostic()?;
+
+    ensure_channel_initialized_fs(target_dir)
+        .await
+        .map_err(|e| miette::miette!("Failed to initialize local channel: {}", e))?;
+
+    let mut subdirs = HashSet::new();
+
+    for package_path in package_paths {
+        let package_name = package_path
+            .file_name()
+            .ok_or_else(|| miette::miette!("Invalid package path"))?;
+
+        let subdir = determine_package_subdir(package_path)?;
+        subdirs.insert(subdir.clone());
+        let target_subdir = target_dir.join(&subdir);
+
+        fs_err::create_dir_all(&target_subdir).into_diagnostic()?;
+        let target_path = target_subdir.join(package_name);
+
+        if target_path.exists() {
+            if skip_existing {
+                pixi_progress::println!(
+                    "{}Skipping '{}' (already exists)",
+                    console::style(console::Emoji("⏭ ", "")).yellow(),
+                    package_name.to_string_lossy()
+                );
+                continue;
+            }
+            if !force {
+                return Err(miette::miette!(
+                    "Package already exists at {}. Use --force to overwrite.",
+                    target_path.display()
+                ));
+            }
+        }
+
+        tracing::info!(
+            "Copying {} to {}",
+            package_path.display(),
+            target_path.display()
+        );
+        fs_err::copy(package_path, &target_path).into_diagnostic()?;
+    }
+
+    tracing::info!("Indexing local channel at {}", target_dir.display());
+
+    for subdir in subdirs {
+        let target_platform = subdir
+            .parse::<Platform>()
+            .map_err(|e| miette::miette!("Invalid platform subdir '{}': {}", subdir, e))?;
+
+        let index_config = IndexFsConfig {
+            channel: target_dir.to_path_buf(),
+            target_platform: Some(target_platform),
+            repodata_patch: None,
+            write_zst: true,
+            write_shards: true,
+            force: false,
+            max_parallel: std::thread::available_parallelism()
+                .map(|p| p.get())
+                .unwrap_or(1),
+            multi_progress: None,
+        };
+
+        index_fs(index_config)
+            .await
+            .map_err(|e| miette::miette!("Failed to index channel: {}", e))?;
+    }
+
+    Ok(())
+}
diff --git a/docs/deployment/prefix.md b/docs/deployment/prefix.md
index f2d5da2629..f79f04b564 100644
--- a/docs/deployment/prefix.md
+++ b/docs/deployment/prefix.md
@@ -31,9 +31,30 @@ You can upload packages directly through the web interface. Navigate to **Upload
 
 ![Upload a package](../assets/prefix_upload_package.png)
 
-Alternatively, you can upload packages using the `pixi` (or `rattler-build`) CLI tool. To do so locally, you need to generate an API key for your user account (User -> Settings -> Api Keys).
+Alternatively, you can build and publish packages using the `pixi` CLI. To do so locally, you need to generate an API key for your user account (User -> Settings -> Api Keys).
+
+The easiest way is to use `pixi publish`, which builds the package and uploads it in one step:
+
+```bash
+# Build and publish in one step
+pixi publish --to https://prefix.dev/<channel-name>
+```
+
+You can also build and upload separately for more control:
 
 ```bash
+# Build first, then upload the artifact
+pixi build --output-dir ./output
+pixi upload prefix --channel <channel-name> ./output/my-package-1.0.0-h123_0.conda
+```
+
+For authentication, log in with `pixi auth login` or pass an API key:
+
+```bash
+# Store credentials in the keychain
+pixi auth login --token $PREFIX_API_KEY https://prefix.dev
+
+# Or pass the API key directly when uploading
 pixi upload prefix --channel <channel-name> <package-file> --api-key $PREFIX_API_KEY
 ```
 
@@ -93,8 +114,11 @@ jobs:
 
       - uses: prefix-dev/setup-pixi@v0.8.0
 
-      - run: pixi run build
-      - run: pixi upload prefix --channel <channel-name> ./my-pkg*.conda
+      # Build and publish in one step — no stored secrets needed!
+      - run: pixi publish --to https://prefix.dev/<channel-name>
+
+      # Or with sigstore attestation for supply chain security:
+      # - run: pixi publish --to https://prefix.dev/<channel-name> --generate-attestation
 ```
 
-The `rattler-build-action` automatically handles the OIDC token exchange with prefix.dev when trusted publishing is configured for the repository and workflow.
+With trusted publishing configured, pixi automatically handles the OIDC token exchange with prefix.dev — no stored API keys required.
diff --git a/docs/reference/cli/pixi.md b/docs/reference/cli/pixi.md
index 6e7998382d..f38ac331e4 100644
--- a/docs/reference/cli/pixi.md
+++ b/docs/reference/cli/pixi.md
@@ -29,6 +29,7 @@ pixi [OPTIONS] [COMMAND]
 | [`list`](pixi/list.md) | List the packages of the current workspace |
 | [`lock`](pixi/lock.md) | Solve environment and update the lock file without installing the environments |
 | [`reinstall`](pixi/reinstall.md) | Re-install an environment, both updating the lockfile and re-installing the environment |
+| [`publish`](pixi/publish.md) | Build a conda package and publish it to a channel. |
 | [`remove`](pixi/remove.md) | Removes dependencies from the workspace |
 | [`run`](pixi/run.md) | Runs task in the pixi environment |
 | [`search`](pixi/search.md) | Search a conda package |
diff --git a/docs/reference/cli/pixi/publish.md b/docs/reference/cli/pixi/publish.md
new file mode 100644
index 0000000000..131ccdcb0b
--- /dev/null
+++ b/docs/reference/cli/pixi/publish.md
@@ -0,0 +1,90 @@
+---
+title: pixi publish
+---
+<!--- This file is autogenerated. Do not edit manually! -->
+# [pixi](../pixi.md) publish
+
+Build a conda package and publish it to a channel.
+
+--8<-- "docs/reference/cli/pixi/publish_extender:description"
+
+## Usage
+```
+pixi publish [OPTIONS] --to <TO>
+```
+
+## Options
+- <a id="arg---target-platform" href="#arg---target-platform">`--target-platform (-t) <TARGET_PLATFORM>`</a>
+:  The target platform to build for (defaults to the current platform)
+<br>**default**: `current_platform`
+- <a id="arg---build-platform" href="#arg---build-platform">`--build-platform <BUILD_PLATFORM>`</a>
+:  The build platform to use for building (defaults to the current platform)
+<br>**default**: `current_platform`
+- <a id="arg---build-dir" href="#arg---build-dir">`--build-dir (-b) <BUILD_DIR>`</a>
+:  The directory to use for incremental builds artifacts
+- <a id="arg---clean" href="#arg---clean">`--clean (-c)`</a>
+:  Whether to clean the build directory before building
+- <a id="arg---path" href="#arg---path">`--path <PATH>`</a>
+:  The path to a directory containing a package manifest, or to a specific manifest file
+- <a id="arg---to" href="#arg---to">`--to <TO>`</a>
+:  The target channel URL to publish packages to
+<br>**required**: `true`
+- <a id="arg---force" href="#arg---force">`--force`</a>
+:  Force overwrite existing packages
+- <a id="arg---skip-existing" href="#arg---skip-existing">`--skip-existing <SKIP_EXISTING>`</a>
+:  Skip uploading packages that already exist on the target channel. This is enabled by default. Use `--no-skip-existing` to disable
+<br>**default**: `true`
+<br>**options**: `true`, `false`
+- <a id="arg---generate-attestation" href="#arg---generate-attestation">`--generate-attestation`</a>
+:  Generate sigstore attestation (prefix.dev only)
+
+## Config Options
+- <a id="arg---auth-file" href="#arg---auth-file">`--auth-file <AUTH_FILE>`</a>
+:  Path to the file containing the authentication token
+- <a id="arg---concurrent-downloads" href="#arg---concurrent-downloads">`--concurrent-downloads <CONCURRENT_DOWNLOADS>`</a>
+:  Max concurrent network requests, default is `50`
+- <a id="arg---concurrent-solves" href="#arg---concurrent-solves">`--concurrent-solves <CONCURRENT_SOLVES>`</a>
+:  Max concurrent solves, default is the number of CPUs
+- <a id="arg---pinning-strategy" href="#arg---pinning-strategy">`--pinning-strategy <PINNING_STRATEGY>`</a>
+:  Set pinning strategy
+<br>**options**: `semver`, `minor`, `major`, `latest-up`, `exact-version`, `no-pin`
+- <a id="arg---pypi-keyring-provider" href="#arg---pypi-keyring-provider">`--pypi-keyring-provider <PYPI_KEYRING_PROVIDER>`</a>
+:  Specifies whether to use the keyring to look up credentials for PyPI
+<br>**options**: `disabled`, `subprocess`
+- <a id="arg---run-post-link-scripts" href="#arg---run-post-link-scripts">`--run-post-link-scripts`</a>
+:  Run post-link scripts (insecure)
+- <a id="arg---tls-no-verify" href="#arg---tls-no-verify">`--tls-no-verify`</a>
+:  Do not verify the TLS certificate of the server
+- <a id="arg---tls-root-certs" href="#arg---tls-root-certs">`--tls-root-certs <TLS_ROOT_CERTS>`</a>
+:  Which TLS root certificates to use: 'webpki' (bundled Mozilla roots), 'native' (system store), or 'all' (both)
+<br>**env**: `PIXI_TLS_ROOT_CERTS`
+- <a id="arg---use-environment-activation-cache" href="#arg---use-environment-activation-cache">`--use-environment-activation-cache`</a>
+:  Use environment activation cache (experimental)
+
+## Update Options
+- <a id="arg---no-install" href="#arg---no-install">`--no-install`</a>
+:  Don't modify the environment, only modify the lock-file
+- <a id="arg---frozen" href="#arg---frozen">`--frozen`</a>
+:  Install the environment as defined in the lockfile, doesn't update lockfile if it isn't up-to-date with the manifest file
+<br>**env**: `PIXI_FROZEN`
+- <a id="arg---locked" href="#arg---locked">`--locked`</a>
+:  Check if lockfile is up-to-date before installing the environment, aborts when lockfile isn't up-to-date with the manifest file
+<br>**env**: `PIXI_LOCKED`
+- <a id="arg---as-is" href="#arg---as-is">`--as-is`</a>
+:  Shorthand for the combination of --no-install and --frozen
+
+## Description
+Build a conda package and publish it to a channel.
+
+This is a convenience command that combines `pixi build` and `pixi upload`.
+
+Supported target channel URLs:
+  - prefix.dev: `https://prefix.dev/<channel-name>`
+  - anaconda.org: `https://anaconda.org/<owner>/<label>`
+  - S3: `s3://bucket-name`
+  - Filesystem: `file:///path/to/channel`
+  - Quetz: `quetz://server/<channel>`
+  - Artifactory: `artifactory://server/<channel>`
+
+
+--8<-- "docs/reference/cli/pixi/publish_extender:example"
diff --git a/docs/reference/cli/pixi/publish_extender b/docs/reference/cli/pixi/publish_extender
new file mode 100644
index 0000000000..a7c1fd467c
--- /dev/null
+++ b/docs/reference/cli/pixi/publish_extender
@@ -0,0 +1,126 @@
+
+--8<-- [start:description]
+
+`pixi publish` is a convenience command that **builds** a conda package from your workspace and **uploads** it to a channel in a single step. It combines the functionality of [`pixi build`](build.md) and [`pixi upload`](upload.md).
+
+The `--to` flag determines the target channel. The upload backend is automatically detected from the URL:
+
+| URL pattern | Backend |
+|-------------|---------|
+| `https://prefix.dev/<channel>` | [prefix.dev](https://prefix.dev) |
+| `https://anaconda.org/<owner>` | [Anaconda.org](https://anaconda.org) |
+| `s3://bucket-name/channel` | S3-compatible storage |
+| `file:///path/to/channel` | Local filesystem |
+| `quetz://server/<channel>` | [Quetz](https://github.com/mamba-org/quetz) |
+| `artifactory://server/<channel>` | [JFrog Artifactory](https://jfrog.com/artifactory/) |
+
+--8<-- [end:description]
+
+--8<-- [start:example]
+
+## Examples
+
+### Publishing to prefix.dev
+
+The most common use case is publishing packages to a channel on [prefix.dev](https://prefix.dev).
+
+```shell
+# Build and publish to your prefix.dev channel
+pixi publish --to https://prefix.dev/my-channel
+
+# Build for a specific target platform and publish
+pixi publish --to https://prefix.dev/my-channel --target-platform linux-64
+
+# Publish with sigstore attestation for supply chain security
+pixi publish --to https://prefix.dev/my-channel --generate-attestation
+
+# Force overwrite existing packages
+pixi publish --to https://prefix.dev/my-channel --force
+```
+
+For authentication, either log in first with `pixi auth login`, or set the `PREFIX_API_KEY` environment variable:
+
+```shell
+# Option 1: Log in (credentials are stored in the keychain)
+pixi auth login --token $MY_TOKEN https://prefix.dev
+pixi publish --to https://prefix.dev/my-channel
+
+# Option 2: Use trusted publishing in CI (no credentials needed)
+pixi publish --to https://prefix.dev/my-channel
+```
+
+See the [prefix.dev deployment guide](../../../deployment/prefix.md) for more details on setting up channels and trusted publishing.
+
+### Publishing to Anaconda.org
+
+```shell
+# Build and publish to your Anaconda.org account
+pixi publish --to https://anaconda.org/my-username
+
+# Publish to a specific label/channel
+pixi publish --to https://anaconda.org/my-username/dev
+```
+
+### Publishing to S3
+
+When publishing to S3, the channel is automatically initialized (if new) and indexed after the upload.
+
+```shell
+# Build and publish to an S3 bucket (using AWS credentials from environment)
+pixi publish --to s3://my-bucket/my-channel
+```
+
+S3 credentials are resolved from the standard AWS credential chain (environment variables, shared credentials file, instance profiles, etc.).
+
+### Publishing to a local filesystem channel
+
+Local channels are useful for development and testing. The channel directory is automatically created and indexed.
+
+```shell
+# Build and publish to a local channel
+pixi publish --to file:///path/to/my-channel
+
+# Force overwrite if the package already exists
+pixi publish --to file:///path/to/my-channel --force
+```
+
+### Publishing from a specific manifest
+
+```shell
+# Publish a package from a specific recipe
+pixi publish --to https://prefix.dev/my-channel --path ./my-recipe/recipe.yaml
+
+# Publish from a different workspace
+pixi publish --to https://prefix.dev/my-channel --path ./my-project/
+```
+
+### Clean rebuild and publish
+
+```shell
+# Clean the build directory before building and publishing
+pixi publish --to https://prefix.dev/my-channel --clean
+```
+
+## Authentication
+
+`pixi publish` uses the same authentication system as other pixi commands. Credentials can be configured in three ways:
+
+1. **Keychain / auth-file**: Use `pixi auth login` to store credentials
+   ```shell
+   pixi auth login --token $MY_TOKEN https://prefix.dev
+   ```
+
+2. **Trusted publishing (CI)**: On GitHub Actions, GitLab CI, or Google Cloud, prefix.dev supports OIDC-based trusted publishing — no stored secrets required. See the [prefix.dev trusted publishing guide](../../../deployment/prefix.md#trusted-publishing).
+
+3. **Environment variables**:
+   - `PREFIX_API_KEY` for prefix.dev
+   - `ANACONDA_API_KEY` for Anaconda.org
+   - `QUETZ_API_KEY` for Quetz
+   - `ARTIFACTORY_TOKEN` for Artifactory
+   - Standard AWS environment variables for S3
+
+## Comparison with `pixi build` + `pixi upload`
+
+`pixi publish` is a shorthand for running `pixi build` followed by `pixi upload`. Use it when you want a single command to build and deploy. If you need more control over the build output before uploading (e.g., testing the package locally), use `pixi build` and `pixi upload` separately.
+
+--8<-- [end:example]
diff --git a/tests/integration_python/test_main_cli.py b/tests/integration_python/test_main_cli.py
index 740e6f11fe..03230b6835 100644
--- a/tests/integration_python/test_main_cli.py
+++ b/tests/integration_python/test_main_cli.py
@@ -1306,6 +1306,8 @@ def check_invariants(command_name: str) -> None:
         (["upgrade"], [], "pixi upgrade"),
         # Pixi build (can lock its source)
         (["build"], [], "pixi build"),
+        # Pixi publish (builds and uploads)
+        (["publish", "--to", "https://prefix.dev/test-channel"], [], "pixi publish"),
     ]
     # This command needs to stay last so we always have something that requires a re-solve
     # Dont move this!
@@ -1330,6 +1332,21 @@ def check_invariants(command_name: str) -> None:
             verify_cli_command(
                 [pixi, "build", "--path", manifest_path, "--locked", "--no-install"],
             )
+        elif command_name == "pixi publish":
+            # Special case: publish uses --path instead of --manifest-path
+            verify_cli_command(
+                [
+                    pixi,
+                    "publish",
+                    "--to",
+                    "https://prefix.dev/test-channel",
+                    "--path",
+                    manifest_path,
+                    "--frozen",
+                    "--no-install",
+                ],
+                expected_exit_code=ExitCode.FAILURE,
+            )
         else:
             verify_cli_command([pixi, *command_parts, *frozen_no_install_flags, *additional_args])
         check_invariants(command_name)