diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ba0bd50..71d59a1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,3 +62,20 @@
             bin/macos/cmc-tagger
             bin/win/cmc-tagger.exe
           generate_release_notes: true
+
+  publish-npm:
+    needs: test
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      id-token: write   # required for npm trusted publishing (OIDC)
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm install -g npm@latest   # OIDC/trusted publishing needs npm >= 11.5.1
+      - run: npm ci
+      - run: npm publish   # no token: authenticates via OIDC, provenance is automatic