diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..d290268
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,45 @@
+name: Publish to NPM
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: npm install --no-audit --no-fund
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+
+      - name: Resolve dist tag
+        id: dist-tag
+        run: |
+          node - <<'NODE' >> "$GITHUB_OUTPUT"
+          const { readFileSync } = require("node:fs");
+          const pkg = JSON.parse(readFileSync("package.json", "utf8"));
+          console.log(`tag=${pkg.version.includes("-") ? "alpha" : "latest"}`);
+          NODE
+
+      - name: Publish to npm
+        run: npm publish --access public --tag "${{ steps.dist-tag.outputs.tag }}"
diff --git a/README.md b/README.md
index b858043..749d7d7 100644
--- a/README.md
+++ b/README.md
@@ -93,6 +93,22 @@ npm test
 npm run build
 ```
 
+## Release
+
+Publishing is handled by `.github/workflows/publish.yml` when a GitHub release
+is published. The workflow uses npm trusted publishing/OIDC and automatically
+uses the `alpha` dist-tag for prerelease versions such as `0.1.0-alpha.1`.
+
+Configure the package trusted publisher on npmjs.com with:
+
+- Publisher: GitHub Actions
+- Organization or user: `useorgx`
+- Repository: `orgx-opencode-plugin`
+- Workflow filename: `publish.yml`
+
+The package `repository.url` must keep matching this GitHub repository exactly,
+otherwise npm trusted publishing can fail authentication.
+
 ## Status
 
 Alpha. Part of the Sovereign Execution initiative (`993cabeb`).
diff --git a/package.json b/package.json
index e03e73b..e1cec31 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,11 @@
       "import": "./dist/index.js"
     }
   },
-  "files": ["dist", "README.md", "plugin.manifest.json"],
+  "files": [
+    "dist",
+    "README.md",
+    "plugin.manifest.json"
+  ],
   "scripts": {
     "build": "tsc",
     "type-check": "tsc --noEmit",
@@ -23,7 +27,7 @@
     "start": "node dist/cli.js"
   },
   "dependencies": {
-    "@useorgx/orgx-gateway-sdk": "https://github.com/useorgx/orgx-gateway-sdk#main"
+    "@useorgx/orgx-gateway-sdk": "git+https://github.com/useorgx/orgx-gateway-sdk.git#main"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -33,7 +37,7 @@
   "keywords": ["orgx", "opencode", "plugin-peer", "byok"],
   "repository": {
     "type": "git",
-    "url": "https://github.com/useorgx/orgx-opencode-plugin.git"
+    "url": "git+https://github.com/useorgx/orgx-opencode-plugin.git"
   },
   "license": "UNLICENSED"
 }