diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index dd059d6..dc48d90 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "linear-cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Linear CLI integration for Claude Code - manage issues, teams, and projects",
   "author": {
     "name": "0xbigboss"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e627f9..3d5d733 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,17 @@
 Notable changes per release. Versions before 0.3.0 are recorded in the
 [GitHub releases](https://github.com/alleneubank/linear-cli/releases).
 
+## 0.3.2
+
+### Fixed
+
+- The four npm platform packages had no `repository` field. Trusted publishing
+  generates sigstore provenance automatically, and npm rejects the upload with
+  a 422 when `repository.url` does not match the repo the provenance came from,
+  so the v0.3.1 publish failed after the tag and GitHub release had already
+  gone green. `scripts/check-versions.sh` now checks `repository.url` on every
+  npm manifest, which fails the release before it publishes anything.
+
 ## 0.3.1
 
 The first release published through trusted publishing. Content is identical to
diff --git a/npm/linear-cli-darwin-arm64/package.json b/npm/linear-cli-darwin-arm64/package.json
index c69216f..1eca3cb 100644
--- a/npm/linear-cli-darwin-arm64/package.json
+++ b/npm/linear-cli-darwin-arm64/package.json
@@ -1,6 +1,12 @@
 {
   "name": "@0xbigboss/linear-cli-darwin-arm64",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "description": "Linear CLI binary for darwin-arm64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alleneubank/linear-cli.git"
+  },
+  "license": "MIT",
   "os": [
     "darwin"
   ],
diff --git a/npm/linear-cli-darwin-x64/package.json b/npm/linear-cli-darwin-x64/package.json
index 3d6a160..d476819 100644
--- a/npm/linear-cli-darwin-x64/package.json
+++ b/npm/linear-cli-darwin-x64/package.json
@@ -1,6 +1,12 @@
 {
   "name": "@0xbigboss/linear-cli-darwin-x64",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "description": "Linear CLI binary for darwin-x64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alleneubank/linear-cli.git"
+  },
+  "license": "MIT",
   "os": [
     "darwin"
   ],
diff --git a/npm/linear-cli-linux-arm64/package.json b/npm/linear-cli-linux-arm64/package.json
index 7b9b1be..8314ca2 100644
--- a/npm/linear-cli-linux-arm64/package.json
+++ b/npm/linear-cli-linux-arm64/package.json
@@ -1,6 +1,12 @@
 {
   "name": "@0xbigboss/linear-cli-linux-arm64",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "description": "Linear CLI binary for linux-arm64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alleneubank/linear-cli.git"
+  },
+  "license": "MIT",
   "os": [
     "linux"
   ],
diff --git a/npm/linear-cli-linux-x64/package.json b/npm/linear-cli-linux-x64/package.json
index fcc6f18..ea1e12f 100644
--- a/npm/linear-cli-linux-x64/package.json
+++ b/npm/linear-cli-linux-x64/package.json
@@ -1,6 +1,12 @@
 {
   "name": "@0xbigboss/linear-cli-linux-x64",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "description": "Linear CLI binary for linux-x64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alleneubank/linear-cli.git"
+  },
+  "license": "MIT",
   "os": [
     "linux"
   ],
diff --git a/npm/linear-cli/package.json b/npm/linear-cli/package.json
index 4a3289e..6ab7450 100644
--- a/npm/linear-cli/package.json
+++ b/npm/linear-cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@0xbigboss/linear-cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Linear CLI built with Zig",
   "license": "MIT",
   "repository": {
@@ -11,9 +11,9 @@
     "linear": "bin.js"
   },
   "optionalDependencies": {
-    "@0xbigboss/linear-cli-darwin-arm64": "0.3.1",
-    "@0xbigboss/linear-cli-darwin-x64": "0.3.1",
-    "@0xbigboss/linear-cli-linux-x64": "0.3.1",
-    "@0xbigboss/linear-cli-linux-arm64": "0.3.1"
+    "@0xbigboss/linear-cli-darwin-arm64": "0.3.2",
+    "@0xbigboss/linear-cli-darwin-x64": "0.3.2",
+    "@0xbigboss/linear-cli-linux-x64": "0.3.2",
+    "@0xbigboss/linear-cli-linux-arm64": "0.3.2"
   }
 }
diff --git a/package.json b/package.json
index cc64862..13904c3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "linear-cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Pi package for @0xbigboss/linear-cli: Linear issue/team/project management via the linear CLI. Exposes the linear skill.",
   "license": "MIT",
   "keywords": [
diff --git a/scripts/check-versions.sh b/scripts/check-versions.sh
index 9de5194..79d1f03 100755
--- a/scripts/check-versions.sh
+++ b/scripts/check-versions.sh
@@ -12,6 +12,13 @@
 #   .claude-plugin/plugin.json    Claude Code plugin
 #   npm/*/package.json            npm dist packages
 #   npm/linear-cli optionalDependencies pins
+#   npm/*/package.json repository.url
+#
+# The repository check is here because trusted publishing generates sigstore
+# provenance, and npm rejects the upload when package.json's repository.url
+# does not match the repo the provenance came from. The four platform packages
+# had no repository field at all, which failed the v0.3.1 publish with a 422
+# AFTER the tag, the GitHub release, and every other gate had gone green.
 #
 # Usage: check-versions.sh [--expect <version>]
 #   --expect pins every manifest to that version (CI passes the tag).
@@ -60,6 +67,17 @@ while IFS= read -r pin; do
     fi
 done < <(jq -r '.optionalDependencies // {} | to_entries[] | "\(.key)=\(.value)"' npm/linear-cli/package.json)
 
+# Provenance: npm compares this against the OIDC claim and 422s on a mismatch.
+expected_repo="git+https://github.com/alleneubank/linear-cli.git"
+for f in npm/*/package.json; do
+    url="$(jq -r '.repository.url // empty' "$f")"
+    if [[ -z "$url" ]]; then
+        report "$f: no .repository.url (npm rejects provenance without it)"
+    elif [[ "$url" != "$expected_repo" ]]; then
+        report "$f: repository.url is '$url', expected '$expected_repo'"
+    fi
+done
+
 if [[ $fail -ne 0 ]]; then
     echo "FAIL: manifests disagree${expect:+ with tag $expect}" >&2
     exit 1