diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
new file mode 100644
index 00000000..465589b3
--- /dev/null
+++ b/.github/workflows/publish-npm.yml
@@ -0,0 +1,57 @@
+---
+name: Publish npm
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to publish, e.g. v0.6.3
+        required: true
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-npm
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ github.event.release.tag_name || inputs.tag }}
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6
+    - name: Set up Bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: 1.3.10
+    - name: Set up Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: "24"
+        registry-url: https://registry.npmjs.org
+    # Trusted publishing and `npm stage` need a recent npm.
+    - name: Update npm
+      run: npm install -g npm@latest
+    - name: Download release binaries.json
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        mkdir -p packages/cli/dist/bin
+        gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern binaries.json --dir packages/cli/dist/bin
+        version="${TAG#v}"
+        test "$(jq -r .version packages/cli/package.json)" = "$version"
+        test "$(jq -r .version packages/cli/dist/bin/binaries.json)" = "$version"
+        test "$(jq '.artifacts | length' packages/cli/dist/bin/binaries.json)" -eq 4
+    - name: Build npm package
+      working-directory: packages/npm
+      run: bun run build
+    # Stage only: a maintainer approves the version on npmjs.com (Staged Packages) before it goes live.
+    - name: Stage publish
+      working-directory: packages/npm
+      run: npm stage publish
diff --git a/packages/npm/package.json b/packages/npm/package.json
index 71f26a60..a0f7b991 100644
--- a/packages/npm/package.json
+++ b/packages/npm/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.3",
   "description": "Beeper CLI binary launcher",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/beeper/cli.git",
+    "directory": "packages/npm"
+  },
   "type": "module",
   "bin": {
     "beeper": "bin/beeper.js"