diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2ee37e5..8c2f933 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -38,5 +38,3 @@ jobs:
             echo "dist=latest" >> "$GITHUB_OUTPUT"
           fi
       - run: npm publish --provenance --access public --tag ${{ steps.tag.outputs.dist }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/README.md b/README.md
index 6e4ae90..fceb633 100644
--- a/README.md
+++ b/README.md
@@ -45,9 +45,14 @@ the built binary and check its output, so `npm test` builds first.
 Pushing a version tag runs the publish workflow, which lints, builds, tests, then
 publishes to npm with provenance.
 
+Main only takes pull requests, so bump `package.json` on a branch and deliver it
+as a pull request. Once that merges, tag the merge commit on main and push the
+tag. Tagging the branch commit instead would leave the tag pointing at a commit
+the squash merge discards.
+
 ```
-npm version patch      # bumps package.json and creates the tag
-git push --follow-tags
+git tag v0.0.2 <merge commit>
+git push origin v0.0.2
 ```
 
 A plain tag (`v0.0.1`) publishes under `latest`. A prerelease tag (`v0.0.1-rc.1`)
diff --git a/package-lock.json b/package-lock.json
index 77736d2..42b97ff 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@gaffa-dev/cli",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@gaffa-dev/cli",
-      "version": "0.0.1",
+      "version": "0.0.2",
       "license": "MIT",
       "bin": {
         "gaffa": "dist/cli.js"
diff --git a/package.json b/package.json
index 79e19f8..08458ec 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gaffa-dev/cli",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "The Gaffa command line tool.",
   "license": "MIT",
   "author": {