diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
new file mode 100644
index 0000000..c9c7cba
--- /dev/null
+++ b/.github/workflows/publish-npm.yml
@@ -0,0 +1,46 @@
+name: Publish npm package
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Require the main branch
+        if: github.ref != 'refs/heads/main'
+        run: |
+          echo "Refusing to publish from $GITHUB_REF; dispatch this workflow from main."
+          exit 1
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+
+      - name: Configure npm trusted publishing
+        run: |
+          npm install --global npm@12.0.2
+          npm config set registry https://registry.npmjs.org
+
+      - name: Verify package contents and installation
+        run: |
+          npm pack --dry-run --json
+          package_tarball="$(npm pack --pack-destination "$RUNNER_TEMP" --silent)"
+          install_dir="$(mktemp -d)"
+          npm install --ignore-scripts --prefix "$install_dir" "$RUNNER_TEMP/$package_tarball"
+          node -e "const p = require(process.argv[1]); if (p.name !== '@paadev/paa-contracts') process.exit(1)" \
+            "$install_dir/node_modules/@paadev/paa-contracts/package.json"
+
+      - name: Publish package
+        run: npm publish --access public
diff --git a/package.json b/package.json
index 53a76fd..b3eafef 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@rankonelabs/paa-contracts",
+  "name": "@paadev/paa-contracts",
   "version": "0.1.0",
   "description": "Published contract artifacts of the Progressive Autonomy Architecture: four normative JSON Schemas, the positive fixture corpus every implementation is checked against, and the table-driven invalid-case matrices.",
   "license": "MIT",