diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 0000000..cd34c2a
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,31 @@
+name: publish
+
+# Auth: npm trusted publishing (OIDC) — requires one-time setup on npmjs.com
+# (package Settings > Trusted Publisher: this repo + this workflow).
+
+on:
+  release:
+    types: [published]
+
+permissions: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # OIDC trusted publishing + provenance
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - name: Check that the release tag matches the package version
+        run: |
+          version=$(node -p 'require("./package.json").version')
+          test "$GITHUB_REF_NAME" = "v$version"
+      # No install or checks: `check` already gates every push, and publishing
+      # needs no node_modules — so no registry-delivered code runs with
+      # id-token authority.
+      - run: npm publish --ignore-scripts
diff --git a/README.md b/README.md
index baaccb9..298654a 100644
--- a/README.md
+++ b/README.md
@@ -24,10 +24,14 @@ change when links actually change.
 
 ## Install
 
-Until this package is published to the npm registry, install it from GitHub:
+```sh
+npm install --save-dev link-cache
+```
+
+Or, to install from GitHub rather than the npm registry:
 
 ```sh
-npm install --save-dev github:chalin/link-cache
+npm install --save-dev github:chalin/link-cache#semver:^0.3.0
 ```
 
 This puts both bins on your project's `PATH`.
diff --git a/package.json b/package.json
index 6f877a2..a8de595 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "link-cache",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Zero-dependency helper CLIs for cached Lychee link-checking: lychee-norm-cache (run + normalize .lycheecache) and refcache (inspect/prune the cache).",
   "keywords": [
     "lychee",