diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cef50ba6..497f59b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -205,12 +205,12 @@ jobs:
       - name: Make target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
         shell: bash
-        run: mkdir -p github/target github-actions/target kernel/target versioning/target ci-release/target scalafix/target site/target ci-signing/target mergify/target unidoc/target mima/target no-publish/target sonatype/target ci/target sonatype-ci-release/target core/target settings/target project/target
+        run: mkdir -p github/target github-actions/target kernel/target versioning/target ci-release/target scalafix/target site/target ci-signing/target mergify/target unidoc/target mima/target site-ci-release/target no-publish/target sonatype/target ci/target sonatype-ci-release/target core/target settings/target project/target
 
       - name: Compress target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
         shell: bash
-        run: tar cf targets.tar github/target github-actions/target kernel/target versioning/target ci-release/target scalafix/target site/target ci-signing/target mergify/target unidoc/target mima/target no-publish/target sonatype/target ci/target sonatype-ci-release/target core/target settings/target project/target
+        run: tar cf targets.tar github/target github-actions/target kernel/target versioning/target ci-release/target scalafix/target site/target ci-signing/target mergify/target unidoc/target mima/target site-ci-release/target no-publish/target sonatype/target ci/target sonatype-ci-release/target core/target settings/target project/target
 
       - name: Upload target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
@@ -221,7 +221,7 @@ jobs:
 
   publish:
     name: Publish Artifacts
-    needs: [build]
+    needs: [build, site]
     if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
     strategy:
       matrix:
@@ -340,6 +340,16 @@ jobs:
           tar xf targets.tar
           rm targets.tar
 
+      - name: Download target directories (site)
+        uses: actions/download-artifact@v3
+        with:
+          name: site
+
+      - name: Inflate target directories (site)
+        run: |
+          tar xf targets.tar
+          rm targets.tar
+
       - name: Import signing key
         if: env.PGP_SECRET != '' && env.PGP_PASSPHRASE == ''
         env:
@@ -476,7 +486,7 @@ jobs:
       - name: Submit Dependencies
         uses: scalacenter/sbt-dependency-submission@v2
         with:
-          modules-ignore: sbt-typelevelJVM docs sbt-typelevelNative sbt-typelevel sbt-typelevelJS
+          modules-ignore: sbt-typelevelJVM sbt-typelevelNative sbt-typelevel sbt-typelevelJS docs
           configs-ignore: test scala-tool scala-doc-tool
 
   validate-steward:
@@ -613,3 +623,40 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: mdocs/target/docs/site
           keep_files: true
+
+      - name: Import signing key
+        if: env.PGP_SECRET != '' && env.PGP_PASSPHRASE == ''
+        env:
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
+        run: echo $PGP_SECRET | base64 -di | gpg --import
+
+      - name: Import signing key and strip passphrase
+        if: env.PGP_SECRET != '' && env.PGP_PASSPHRASE != ''
+        env:
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
+        run: |
+          echo "$PGP_SECRET" | base64 -di > /tmp/signing-key.gpg
+          echo "$PGP_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --import /tmp/signing-key.gpg
+          (echo "$PGP_PASSPHRASE"; echo; echo) | gpg --command-fd 0 --pinentry-mode loopback --change-passphrase $(gpg --list-secret-keys --with-colons 2> /dev/null | grep '^sec:' | cut --delimiter ':' --fields 5 | tail -n 1)
+
+      - name: Publish site to sonatype
+        if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
+        env:
+          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+          SONATYPE_CREDENTIAL_HOST: ${{ secrets.SONATYPE_CREDENTIAL_HOST }}
+        run: sbt docs/publish
+
+      - name: Make target directories
+        run: mkdir -p target
+
+      - name: Compress target directories
+        run: tar cf targets.tar target
+
+      - name: Upload target directories
+        uses: actions/upload-artifact@v3
+        with:
+          name: site
+          path: targets.tar
diff --git a/.mergify.yml b/.mergify.yml
index 1a48bc1d..2210e2c5 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -146,6 +146,14 @@ pull_request_rules:
       add:
       - site
       remove: []
+- name: Label site-ci-release PRs
+  conditions:
+  - files~=^site-ci-release/
+  actions:
+    label:
+      add:
+      - site-ci-release
+      remove: []
 - name: Label sonatype PRs
   conditions:
   - files~=^sonatype/
diff --git a/build.sbt b/build.sbt
index 2d150aed..c9647d82 100644
--- a/build.sbt
+++ b/build.sbt
@@ -61,11 +61,11 @@ lazy val `sbt-typelevel` = tlCrossRootProject.aggregate(
   ciSigning,
   sonatypeCiRelease,
   ci,
-  core,
   ciRelease,
   site,
-  unidoc,
-  docs
+  siteCiRelease,
+  core,
+  unidoc
 )
 
 lazy val kernel = project
@@ -187,6 +187,22 @@ lazy val ciRelease = project
     ciSigning
   )
 
+lazy val site = project
+  .in(file("site"))
+  .enablePlugins(SbtPlugin)
+  .settings(
+    name := "sbt-typelevel-site"
+  )
+  .dependsOn(kernel, github, githubActions, noPublish)
+
+lazy val siteCiRelease = project
+  .in(file("site-ci-release"))
+  .enablePlugins(SbtPlugin)
+  .settings(
+    name := "sbt-typelevel-site-ci-release"
+  )
+  .dependsOn(site, sonatypeCiRelease, ciSigning)
+
 lazy val core = project
   .in(file("core"))
   .enablePlugins(SbtPlugin)
@@ -195,17 +211,10 @@ lazy val core = project
   )
   .dependsOn(
     ciRelease,
-    settings
+    settings,
+    siteCiRelease
   )
 
-lazy val site = project
-  .in(file("site"))
-  .enablePlugins(SbtPlugin)
-  .settings(
-    name := "sbt-typelevel-site"
-  )
-  .dependsOn(kernel, github, githubActions, noPublish)
-
 lazy val unidoc = project
   .in(file("unidoc"))
   .enablePlugins(TypelevelUnidocPlugin)
@@ -217,6 +226,7 @@ lazy val docs = project
   .in(file("mdocs"))
   .enablePlugins(TypelevelSitePlugin)
   .settings(
+    name := "sbt-typelevel-website",
     laikaConfig ~= { _.withRawContent },
     tlSiteApiPackage := Some("org.typelevel.sbt"),
     tlSiteHelium ~= {
diff --git a/ci-signing/src/main/scala/org/typelevel/sbt/TypelevelCiSigningPlugin.scala b/ci-signing/src/main/scala/org/typelevel/sbt/TypelevelCiSigningPlugin.scala
index bee1f008..9be1b38a 100644
--- a/ci-signing/src/main/scala/org/typelevel/sbt/TypelevelCiSigningPlugin.scala
+++ b/ci-signing/src/main/scala/org/typelevel/sbt/TypelevelCiSigningPlugin.scala
@@ -26,12 +26,18 @@ import Keys._
 
 object TypelevelCiSigningPlugin extends AutoPlugin {
 
+  object autoImport {
+    lazy val tlCiSigningImportKey = settingKey[Seq[WorkflowStep]]("Steps to import the PGP key")
+  }
+
+  import autoImport._
+
   override def requires = SbtGpg && GitHubActionsPlugin && GenerativePlugin
 
   override def trigger = allRequirements
 
   override def buildSettings = Seq(
-    githubWorkflowPublishPreamble := Seq(
+    tlCiSigningImportKey := Seq(
       WorkflowStep.Run( // if your key is not passphrase-protected
         List("echo $PGP_SECRET | base64 -di | gpg --import"),
         name = Some("Import signing key"),
@@ -48,7 +54,8 @@ object TypelevelCiSigningPlugin extends AutoPlugin {
         cond = Some("env.PGP_SECRET != '' && env.PGP_PASSPHRASE != ''"),
         env = env
       )
-    )
+    ),
+    githubWorkflowPublishPreamble := tlCiSigningImportKey.value
   )
 
   import SbtGpg.autoImport._
diff --git a/ci/src/main/scala/org/typelevel/sbt/TypelevelCiPlugin.scala b/ci/src/main/scala/org/typelevel/sbt/TypelevelCiPlugin.scala
index 8787e6a7..cd204b60 100644
--- a/ci/src/main/scala/org/typelevel/sbt/TypelevelCiPlugin.scala
+++ b/ci/src/main/scala/org/typelevel/sbt/TypelevelCiPlugin.scala
@@ -46,6 +46,9 @@ object TypelevelCiPlugin extends AutoPlugin {
 
     lazy val tlCiDependencyGraphJob =
       settingKey[Boolean]("Whether to add a job to submit dependencies to GH (default: true)")
+    lazy val tlCiDependencyIgnoreModules =
+      settingKey[Seq[ProjectRef]](
+        "Modules to ignore in dependency submission job (default: no-publish modules)")
 
     lazy val tlCiStewardValidateConfig = settingKey[Option[File]](
       "The location of the Scala Steward config to validate (default: `.scala-steward.conf`, if exists)")
@@ -61,6 +64,7 @@ object TypelevelCiPlugin extends AutoPlugin {
     tlCiMimaBinaryIssueCheck := false,
     tlCiDocCheck := false,
     tlCiDependencyGraphJob := true,
+    tlCiDependencyIgnoreModules := noPublishProjectRefs.value,
     githubWorkflowTargetBranches ++= Seq(
       "!update/**", // ignore steward branches
       "!pr/**" // escape-hatch to disable ci on a branch
@@ -148,7 +152,7 @@ object TypelevelCiPlugin extends AutoPlugin {
               steps = githubWorkflowJobSetup.value.toList :+
                 WorkflowStep.DependencySubmission(
                   None,
-                  Some(noPublishProjectRefs.value.toList.map(_.project)),
+                  Some(tlCiDependencyIgnoreModules.value.toList.map(_.project)),
                   Some(List("test", "scala-tool", "scala-doc-tool")),
                   None
                 ),
diff --git a/docs/customization.md b/docs/customization.md
index 85612b51..09875e3d 100644
--- a/docs/customization.md
+++ b/docs/customization.md
@@ -54,7 +54,8 @@ Instead of using the super-plugins, for finer-grained control you can always add
 - `tlCiScalafixCheck` (setting): Whether to do scalafix check in CI (default: `false`).
 - `tlCiMimaBinaryIssueCheck` (setting): Whether to do MiMa binary issues check in CI (default: `false`).
 - `tlCiDocCheck` (setting): Whether to build API docs in CI (default: `false`).
-- `tlCiDependencyGraphJob` (setting): Whether to add a job to submit dependencies to GH (default: `true`)
+- `tlCiDependencyGraphJob` (setting): Whether to add a job to submit dependencies to GH (default: `true`).
+- `tlCiDependencyIgnoreModules` (setting): "Modules to ignore in dependency submission job (default: no-publish modules).
 - `tlCiStewardValidateConfig` (setting): The location of the Scala Steward config to validate (default: `.scala-steward.conf`, if exists).
 - `tlCrossRootProject` (method): helper to create a `root` project that can aggregate both `Project`s and `CrossProject`s. Automatically creates separate jobs in the CI matrix for each platform (JVM, JS, etc.).
 
diff --git a/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativeKeys.scala b/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativeKeys.scala
index eb7fbc0e..c84c3340 100644
--- a/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativeKeys.scala
+++ b/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativeKeys.scala
@@ -76,6 +76,8 @@ trait GenerativeKeys {
     "A set of branch predicates which will be applied to determine whether the current branch gets a publication stage; if empty, publish will be skipped entirely (default: [== main])")
   lazy val githubWorkflowPublishCond = settingKey[Option[String]](
     "A set of conditionals to apply to the publish job to further restrict its run (default: [])")
+  lazy val githubWorkflowPublishNeeds =
+    settingKey[Set[String]]("A set of job IDs the publish job needs (default: {build})")
   lazy val githubWorkflowPublishTimeoutMinutes = settingKey[Option[Int]](
     "The maximum number of minutes to let the publish job run before GitHub automatically cancels it (default: None)")
 
@@ -99,6 +101,8 @@ trait GenerativeKeys {
 
   lazy val githubWorkflowArtifactUpload = settingKey[Boolean](
     "Controls whether or not to upload target directories in the event that multiple jobs are running sequentially. Can be set on a per-project basis (default: true)")
+  lazy val githubWorkflowArtifactDownloadExtraArtifacts =
+    settingKey[Set[String]]("Additional artifacts which should be downloaded (default: {})")
   lazy val githubWorkflowArtifactDownloadExtraKeys = settingKey[Set[String]](
     "Additional matrix keys for which *all* artifacts should be downloaded and not just for the primary value (default: {})")
   lazy val githubWorkflowJobSetup = settingKey[Seq[WorkflowStep]](
diff --git a/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativePlugin.scala b/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativePlugin.scala
index e77269f2..401cf392 100644
--- a/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativePlugin.scala
+++ b/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativePlugin.scala
@@ -19,7 +19,6 @@ package org.typelevel.sbt.gha
 import sbt.Keys._
 import sbt._
 
-import java.nio.file.FileSystems
 import scala.io.Source
 
 object GenerativePlugin extends AutoPlugin {
@@ -577,6 +576,7 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
       WorkflowStep.Sbt(List("+publish"), name = Some("Publish project"))),
     githubWorkflowPublishTargetBranches := Seq(RefPredicate.Equals(Ref.Branch("main"))),
     githubWorkflowPublishCond := None,
+    githubWorkflowPublishNeeds := Set("build"),
     githubWorkflowPublishTimeoutMinutes := None,
     githubWorkflowJavaVersions := Seq(JavaSpec.temurin("11")),
     githubWorkflowScalaVersions := {
@@ -601,21 +601,16 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
 
   private val windowsGuard = Some("contains(runner.os, 'windows')")
 
-  private val PlatformSep = FileSystems.getDefault.getSeparator
-  private def normalizeSeparators(pathStr: String): String = {
-    pathStr.replace(PlatformSep, "/") // *force* unix separators
-  }
-
-  private val pathStrs = Def setting {
+  private val relativePaths = Def setting {
     val base = (ThisBuild / baseDirectory).value.toPath
 
     internalTargetAggregation.value map { file =>
       val path = file.toPath
 
       if (path.isAbsolute)
-        normalizeSeparators(base.relativize(path).toString)
+        base.relativize(path)
       else
-        normalizeSeparators(path.toString)
+        path
     }
   }
 
@@ -624,40 +619,21 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
 
   override def buildSettings = settingDefaults ++ Seq(
     githubWorkflowPREventTypes := PREventType.Defaults,
+    githubWorkflowArtifactDownloadExtraArtifacts := Set.empty,
     githubWorkflowArtifactDownloadExtraKeys := Set.empty,
     githubWorkflowGeneratedUploadSteps := {
       val generate =
         githubWorkflowArtifactUpload.value &&
           githubWorkflowPublishTargetBranches.value.nonEmpty
       if (generate) {
-        val sanitized = pathStrs.value map { str =>
-          if (str.indexOf(' ') >= 0) // TODO be less naive
-            s"'$str'"
-          else
-            str
-        }
-
-        val mkdir = WorkflowStep.Run(
-          List(s"mkdir -p ${sanitized.mkString(" ")} project/target"),
-          name = Some("Make target directories"),
-          cond = Some(publicationCond.value))
-
-        val tar = WorkflowStep.Run(
-          List(s"tar cf targets.tar ${sanitized.mkString(" ")} project/target"),
-          name = Some("Compress target directories"),
-          cond = Some(publicationCond.value))
-
         val keys = githubWorkflowBuildMatrixAdditions.value.keys.toList.sorted
-        val artifactId = MatrixKeys.groupId(keys)
-
-        val upload = WorkflowStep.Use(
-          UseRef.Public("actions", "upload-artifact", "v3"),
-          name = Some(s"Upload target directories"),
-          params = Map("name" -> s"target-$artifactId", "path" -> "targets.tar"),
-          cond = Some(publicationCond.value)
-        )
-
-        Seq(mkdir, tar, upload)
+        val artifactId = "target-" + MatrixKeys.groupId(keys)
+        WorkflowStep
+          .upload(
+            relativePaths.value.toList :+ java.nio.file.Paths.get("project", "target"),
+            artifactId
+          )
+          .map(_.withCond(Some(publicationCond.value)))
       } else {
         Seq()
       }
@@ -679,7 +655,7 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
       val exclusions = githubWorkflowBuildMatrixExclusions.value.toList
 
       // we build the list of artifacts, by iterating over all combinations of keys
-      val artifacts =
+      val matrixArtifacts =
         expandMatrix(
           oses,
           scalas,
@@ -690,24 +666,29 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
         ).map {
           case _ :: scala :: _ :: tail => scala :: tail
           case _ => sys.error("Bug generating artifact download steps") // shouldn't happen
-        }
-
-      if (githubWorkflowArtifactUpload.value) {
-        artifacts flatMap { v =>
+        }.map { v =>
           val pretty = v.mkString(", ")
+          val id = s"target-$${{ matrix.os }}-$${{ matrix.java }}-${v.mkString("-")}"
+          (pretty, id)
+        }
 
-          val download = WorkflowStep.Use(
-            UseRef.Public("actions", "download-artifact", "v3"),
-            name = Some(s"Download target directories ($pretty)"),
-            params =
-              Map("name" -> s"target-$${{ matrix.os }}-$${{ matrix.java }}-${v.mkString("-")}")
-          )
-
-          val untar = WorkflowStep.Run(
-            List("tar xf targets.tar", "rm targets.tar"),
-            name = Some(s"Inflate target directories ($pretty)"))
+      val artifacts =
+        matrixArtifacts ++ githubWorkflowArtifactDownloadExtraArtifacts.value.map(x => (x, x))
 
-          Seq(download, untar)
+      if (githubWorkflowArtifactUpload.value) {
+        artifacts flatMap {
+          case (pretty, id) =>
+            val download = WorkflowStep.Use(
+              UseRef.Public("actions", "download-artifact", "v3"),
+              name = Some(s"Download target directories ($pretty)"),
+              params = Map("name" -> id)
+            )
+
+            val untar = WorkflowStep.Run(
+              List("tar xf targets.tar", "rm targets.tar"),
+              name = Some(s"Inflate target directories ($pretty)"))
+
+            Seq(download, untar)
         }
       } else {
         Seq()
@@ -753,7 +734,7 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
           scalas = List.empty,
           sbtStepPreamble = List.empty,
           javas = List(githubWorkflowJavaVersions.value.head),
-          needs = List("build"),
+          needs = githubWorkflowPublishNeeds.value.toList.sorted,
           timeoutMinutes = githubWorkflowPublishTimeoutMinutes.value
         )).filter(_ => githubWorkflowPublishTargetBranches.value.nonEmpty)
 
@@ -783,7 +764,7 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
     }
   )
 
-  private val publicationCond = Def setting {
+  private[sbt] val publicationCond = Def setting {
     val publicationCondPre =
       githubWorkflowPublishTargetBranches
         .value
diff --git a/github-actions/src/main/scala/org/typelevel/sbt/gha/WorkflowStep.scala b/github-actions/src/main/scala/org/typelevel/sbt/gha/WorkflowStep.scala
index ad0f9b51..eb840e6f 100644
--- a/github-actions/src/main/scala/org/typelevel/sbt/gha/WorkflowStep.scala
+++ b/github-actions/src/main/scala/org/typelevel/sbt/gha/WorkflowStep.scala
@@ -16,6 +16,9 @@
 
 package org.typelevel.sbt.gha
 
+import java.nio.file.FileSystems
+import java.nio.file.Path
+
 sealed trait WorkflowStep extends Product with Serializable {
   def id: Option[String]
   def name: Option[String]
@@ -156,4 +159,36 @@ object WorkflowStep {
     def withEnv(env: Map[String, String]) = copy(env = env)
     def withTimeoutMinutes(minutes: Option[Int]) = copy(timeoutMinutes = minutes)
   }
+
+  def upload(paths: List[Path], artifactId: String): List[WorkflowStep] = {
+    val pathStrs = paths.map(path => normalizeSeparators(path.toString))
+
+    val sanitized = pathStrs.map { str =>
+      if (str.indexOf(' ') >= 0) // TODO be less naive
+        s"'$str'"
+      else
+        str
+    }
+
+    val mkdir = WorkflowStep.Run(
+      List(s"mkdir -p ${sanitized.mkString(" ")}"),
+      name = Some("Make target directories"))
+
+    val tar = WorkflowStep.Run(
+      List(s"tar cf targets.tar ${sanitized.mkString(" ")}"),
+      name = Some("Compress target directories"))
+
+    val upload = WorkflowStep.Use(
+      UseRef.Public("actions", "upload-artifact", "v3"),
+      name = Some(s"Upload target directories"),
+      params = Map("name" -> artifactId, "path" -> "targets.tar")
+    )
+
+    List(mkdir, tar, upload)
+  }
+
+  private val PlatformSep = FileSystems.getDefault.getSeparator
+  private def normalizeSeparators(pathStr: String): String = {
+    pathStr.replace(PlatformSep, "/") // *force* unix separators
+  }
 }
diff --git a/project/build.sbt b/project/build.sbt
index e6ecff93..69320a9d 100644
--- a/project/build.sbt
+++ b/project/build.sbt
@@ -11,6 +11,7 @@ val modules = List(
   "no-publish",
   "scalafix",
   "settings",
+  "site-ci-release",
   "site",
   "sonatype",
   "sonatype-ci-release",
diff --git a/site-ci-release/src/main/scala/org/typelevel/sbt/TypelevelSiteCiReleasePlugin.scala b/site-ci-release/src/main/scala/org/typelevel/sbt/TypelevelSiteCiReleasePlugin.scala
new file mode 100644
index 00000000..177f667c
--- /dev/null
+++ b/site-ci-release/src/main/scala/org/typelevel/sbt/TypelevelSiteCiReleasePlugin.scala
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2022 Typelevel
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.typelevel.sbt
+
+import org.typelevel.sbt.gha.GenerativePlugin
+import org.typelevel.sbt.gha.GenerativePlugin.autoImport._
+import sbt.Keys._
+import sbt._
+
+object TypelevelSiteCiReleasePlugin extends AutoPlugin {
+
+  override def requires =
+    TypelevelCiSigningPlugin && TypelevelSitePlugin && TypelevelSonatypeCiReleasePlugin
+
+  override def trigger = allRequirements
+
+  import TypelevelCiSigningPlugin.autoImport._
+  import TypelevelSitePlugin.autoImport._
+
+  override def projectSettings = Seq(
+    githubWorkflowArtifactUpload := false,
+    ThisBuild / githubWorkflowArtifactDownloadExtraArtifacts += "site",
+    ThisBuild / githubWorkflowPublishNeeds += "site",
+    tlSitePublish ++= {
+      tlCiSigningImportKey.value ++ List(
+        WorkflowStep.Sbt(
+          List(s"${thisProject.value.id}/${publish.key.toString}"),
+          name = Some("Publish site to sonatype"),
+          cond = Some(GenerativePlugin.publicationCond.value),
+          env = TypelevelSonatypeCiReleasePlugin.env
+        )
+      ) ++ WorkflowStep.upload(
+        List(java.nio.file.Paths.get("target")),
+        "site"
+      )
+    }
+  )
+
+}
diff --git a/site/src/main/scala/org/typelevel/sbt/TypelevelSitePlugin.scala b/site/src/main/scala/org/typelevel/sbt/TypelevelSitePlugin.scala
index 4cc51453..889834c0 100644
--- a/site/src/main/scala/org/typelevel/sbt/TypelevelSitePlugin.scala
+++ b/site/src/main/scala/org/typelevel/sbt/TypelevelSitePlugin.scala
@@ -78,7 +78,7 @@ object TypelevelSitePlugin extends AutoPlugin {
   import TypelevelGitHubPlugin._
 
   override def requires =
-    MdocPlugin && LaikaPlugin && TypelevelGitHubPlugin && GenerativePlugin && NoPublishPlugin
+    MdocPlugin && LaikaPlugin && TypelevelGitHubPlugin && GenerativePlugin
 
   override def globalSettings = Seq(
     tlSiteApiModule := None
@@ -110,6 +110,10 @@ object TypelevelSitePlugin extends AutoPlugin {
       .value: @nowarn("cat=other-pure-statement"),
     tlSitePreview := previewTask.value,
     Laika / sourceDirectories := Seq(mdocOut.value),
+    Compile / packageDoc / mappings := {
+      (laikaSite / mappings).dependsOn(tlSite).value
+    },
+    SettingKey[Set[ModuleID]]("mimaPreviousArtifacts") := Set.empty,
     laikaTheme := tlSiteHelium.value.build,
     mdocVariables := {
       mdocVariables.value ++
@@ -209,6 +213,11 @@ object TypelevelSitePlugin extends AutoPlugin {
           List.empty
       }
     },
+    // avoid depending directly on sbt-typelevel-ci
+    ThisBuild / SettingKey[Seq[ProjectRef]]("tlCiDependencyIgnoreModules") := {
+      val old = (ThisBuild / SettingKey[Seq[ProjectRef]]("tlCiDependencyIgnoreModules")).?.value
+      old.getOrElse(Seq.empty) :+ thisProjectRef.value
+    },
     ThisBuild / githubWorkflowAddedJobs +=
       WorkflowJob(
         "site",
diff --git a/sonatype-ci-release/src/main/scala/org/typelevel/sbt/TypelevelSonatypeCiReleasePlugin.scala b/sonatype-ci-release/src/main/scala/org/typelevel/sbt/TypelevelSonatypeCiReleasePlugin.scala
index c7bdcf88..dc987058 100644
--- a/sonatype-ci-release/src/main/scala/org/typelevel/sbt/TypelevelSonatypeCiReleasePlugin.scala
+++ b/sonatype-ci-release/src/main/scala/org/typelevel/sbt/TypelevelSonatypeCiReleasePlugin.scala
@@ -64,9 +64,10 @@ object TypelevelSonatypeCiReleasePlugin extends AutoPlugin {
     )
   )
 
-  private val env = List("SONATYPE_USERNAME", "SONATYPE_PASSWORD", "SONATYPE_CREDENTIAL_HOST")
-    .map(k => k -> s"$${{ secrets.$k }}")
-    .toMap
+  private[sbt] val env = List(
+    "SONATYPE_USERNAME",
+    "SONATYPE_PASSWORD",
+    "SONATYPE_CREDENTIAL_HOST").map(k => k -> s"$${{ secrets.$k }}").toMap
 
   private def tlCiReleaseCommand: Command =
     Command.command("tlCiRelease") { state =>