diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..58ac00e
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,34 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  npm-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write        # required for OIDC; publish fails without it
+    defaults:
+      run:
+        working-directory: .opencode-plugin
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      # Trusted publishing needs npm >= 11.5.1; setup-node's bundled npm on
+      # Node 22 is 10.x, so upgrade explicitly rather than relying on what
+      # happens to ship with the runner image.
+      - run: npm install -g npm@latest
+      - run: npm ci
+      - name: Check tag matches package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg=$(node -p "require('./package.json').version")
+          if [ "$tag" != "$pkg" ]; then
+            echo "tag/version mismatch: tag=$tag package.json=$pkg" >&2
+            exit 1
+          fi
+      - run: npm publish
diff --git a/.opencode-plugin/package.json b/.opencode-plugin/package.json
index 1647fba..09514bf 100644
--- a/.opencode-plugin/package.json
+++ b/.opencode-plugin/package.json
@@ -17,7 +17,11 @@
     "email": "support@dynamicagency.com"
   },
   "homepage": "https://github.com/dynamic/throughline",
-  "repository": "https://github.com/dynamic/throughline",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dynamic/throughline.git",
+    "directory": ".opencode-plugin"
+  },
   "bugs": "https://github.com/dynamic/throughline/issues",
   "license": "MIT",
   "keywords": [
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ddb0962..2b2d1ae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to throughline are documented here. Format loosely follows
 
 ## [Unreleased]
 
+### Changed
+- Publishing `@dynamicagency/throughline-opencode` to npm is now automated from a
+  `v*` tag push via npm Trusted Publishing (OIDC) in
+  `.github/workflows/release.yml`, with provenance attestation and no
+  long-lived npm token (issue #61).
+
 ## [0.14.0]
 
 ### Added
diff --git a/README.md b/README.md
index c15f2f9..089b0d8 100644
--- a/README.md
+++ b/README.md
@@ -228,6 +228,11 @@ printed in the injected session-start block (`## throughline vX.Y.Z`) the same w
 it is on Claude Code and Codex - if it lags this repo's releases, your install is
 stale.
 
+Publishing to npm is tag-triggered: pushing a `vX.Y.Z` tag runs a GitHub Actions
+workflow that publishes `@dynamicagency/throughline-opencode` via npm Trusted
+Publishing (OIDC), with no long-lived npm token and an automatic provenance
+attestation on the published package.
+
 **Local-path install (testing unreleased changes).** Point `opencode.json` at a
 checkout of this repo instead of the package name: