diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ccd81de..87cac98 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,18 +4,26 @@ stages:
 
 # Only create pipelines automatically when a Git tag is pushed.
 # Otherwise the pipeline must be started manually (pipeline "Run" / dispatch equivalent).
-workflow:
-  rules:
-    - if: '$CI_COMMIT_TAG'
-      when: always
-    - if: '$CI_PIPELINE_SOURCE == "web"'
-      when: always
-    - when: never
+# workflow:
+#   rules:
+#     - if: '$CI_COMMIT_TAG'
+#       when: always
+#     - if: '$CI_PIPELINE_SOURCE == "web"'
+#       when: always
+#     - when: never
 
 variables:
   DOTNET_CLI_TELEMETRY_OPTOUT: "1"
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "1"
   BUILD_CONFIG: "Release"
+  # NOTE: This project uses repository variables for NuGet auth because secrets
+  # (masked/protected variables) may not be available on your GitLab plan.
+  # Replace the placeholders below with values in the repository, or override
+  # them in your project CI/CD variables when available.
+  # - NUGET_USERNAME : username (can be any value when using a PAT)
+  # - NUGET_PASSWORD : personal access token or project deploy token
+  NUGET_USERNAME: "REPLACE_WITH_USERNAME"
+  NUGET_PASSWORD: "REPLACE_WITH_TOKEN"
 
 # Build job for Windows runner (shell executor). Remove 'image' so the runner uses the host environment.
 build_windows:
@@ -36,6 +44,16 @@ build_windows:
           $dotnetExe = 'dotnet'
         }
 
+        # Configure private NuGet source from GitLab Packages if credentials are provided
+        $nugetUrl = 'https://gitlab.com/api/v4/projects/79509532/packages/nuget/index.json'
+        if ($env:NUGET_USERNAME -and $env:NUGET_PASSWORD) {
+          Write-Host 'Configuring private NuGet source GitLab...'
+          try { & $dotnetExe nuget remove source GitLab } catch {}
+          & $dotnetExe nuget add source $nugetUrl --name GitLab --username $env:NUGET_USERNAME --password $env:NUGET_PASSWORD --store-password-in-clear-text
+        } else {
+          Write-Host 'NUGET_USERNAME/NUGET_PASSWORD not set; skipping private NuGet source configuration.'
+        }
+
         & $dotnetExe --info
         & $dotnetExe restore
         & $dotnetExe build "imagecatalog\ImageCatalog 2.csproj" -c $env:BUILD_CONFIG -v minimal
@@ -69,6 +87,16 @@ publish_release:
         & $dotnetExe publish "imagecatalog\ImageCatalog 2.csproj" -c $env:BUILD_CONFIG -r win-x64 --self-contained false -o publish
         Write-Host "Published to $(pwd)\\publish"
 
+        # Configure private NuGet source from GitLab Packages if credentials are provided
+        $nugetUrl = 'https://gitlab.com/api/v4/projects/79509532/packages/nuget/index.json'
+        if ($env:NUGET_USERNAME -and $env:NUGET_PASSWORD) {
+          Write-Host 'Configuring private NuGet source GitLab...'
+          try { & $dotnetExe nuget remove source GitLab } catch {}
+          & $dotnetExe nuget add source $nugetUrl --name GitLab --username $env:NUGET_USERNAME --password $env:NUGET_PASSWORD --store-password-in-clear-text
+        } else {
+          Write-Host 'NUGET_USERNAME/NUGET_PASSWORD not set; skipping private NuGet source configuration.'
+        }
+
         # Find first file in publish folder
         $file = Get-ChildItem -Path publish -File | Select-Object -First 1; Write-Host "Uploading $($file.FullName)"
         # Upload to GitLab project uploads API to get a public URL for the artifact