diff --git a/.changeset/eql-repoint-manifests-to-stack.md b/.changeset/eql-repoint-manifests-to-stack.md
new file mode 100644
index 000000000..903621653
--- /dev/null
+++ b/.changeset/eql-repoint-manifests-to-stack.md
@@ -0,0 +1,5 @@
+---
+'@cipherstash/eql': patch
+---
+
+Point `repository`, `repository.directory`, and `bugs.url` at `cipherstash/stack` instead of the archived `cipherstash/encrypt-query-language`. Purely metadata — no behaviour change — but required before npm's trusted publishing (already repointed at `cipherstash/stack`) can accept a release: npm rejects a publish whose manifest `repository.url` doesn't match the publishing repository.
diff --git a/packages/eql/crates/eql-bindings/Cargo.toml b/packages/eql/crates/eql-bindings/Cargo.toml
index 962a1f37c..5c443d5cc 100644
--- a/packages/eql/crates/eql-bindings/Cargo.toml
+++ b/packages/eql/crates/eql-bindings/Cargo.toml
@@ -6,8 +6,8 @@ description = "Canonical wire types for EQL payloads — single source of truth
 # crates.io metadata. `license` is REQUIRED by crates.io — publish fails without
 # it. The rest drive discoverability and the docs.rs / crates.io sidebar links.
 license = "MIT"
-repository = "https://github.com/cipherstash/encrypt-query-language"
-homepage = "https://github.com/cipherstash/encrypt-query-language"
+repository = "https://github.com/cipherstash/stack"
+homepage = "https://github.com/cipherstash/stack"
 readme = "README.md"
 keywords = ["encryption", "postgres", "eql", "cipherstash", "searchable"]
 categories = ["cryptography", "database"]
diff --git a/packages/eql/packages/eql/package.json b/packages/eql/packages/eql/package.json
index d1245be5f..36db8bd81 100644
--- a/packages/eql/packages/eql/package.json
+++ b/packages/eql/packages/eql/package.json
@@ -10,12 +10,12 @@
     "typescript"
   ],
   "bugs": {
-    "url": "https://github.com/cipherstash/encrypt-query-language/issues"
+    "url": "https://github.com/cipherstash/stack/issues"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/cipherstash/encrypt-query-language.git",
-    "directory": "packages/eql"
+    "url": "git+https://github.com/cipherstash/stack.git",
+    "directory": "packages/eql/packages/eql"
   },
   "license": "MIT",
   "author": "CipherStash <hello@cipherstash.com>",
diff --git a/scripts/__tests__/eql-repository-urls.test.mjs b/scripts/__tests__/eql-repository-urls.test.mjs
new file mode 100644
index 000000000..a25a29348
--- /dev/null
+++ b/scripts/__tests__/eql-repository-urls.test.mjs
@@ -0,0 +1,64 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { REPO_ROOT } from './lib/repo-root.mjs'
+
+/**
+ * The EQL manifests must name THIS repository, mirroring
+ * ffi-repository-urls.test.mjs.
+ *
+ * npm trusted publishing matches `repository.url` against the repository the
+ * publish runs from, exactly: *"your package's `repository.url` field in
+ * `package.json` must exactly match your GitHub repository"*
+ * (https://docs.npmjs.com/trusted-publishers/). A stale URL does not warn and
+ * does not degrade — the publish is rejected. crates.io applies the same rule
+ * to `repository` in Cargo.toml.
+ *
+ * `repository.directory` is the quieter half. It resolves from the ROOT of the
+ * repository named in `repository.url`, so `packages/eql` addressed the real
+ * package root in the old repo and addresses nothing here, where the npm
+ * package lives at `packages/eql/packages/eql` (the subtree's own nested
+ * package.json, per the verbatim-prefix import). A stale `directory` publishes
+ * fine and silently breaks the source link on the package page — the failure
+ * that gets noticed is the wrong one, which is why both are asserted.
+ */
+
+const EQL_NPM = join(REPO_ROOT, 'packages/eql/packages/eql/package.json')
+const EQL_BINDINGS_CARGO = join(
+  REPO_ROOT,
+  'packages/eql/crates/eql-bindings/Cargo.toml',
+)
+
+/** The repository these packages publish from as of the cutover. */
+const EXPECTED = 'https://github.com/cipherstash/stack'
+
+describe('EQL manifests name this repository', () => {
+  const pkg = JSON.parse(readFileSync(EQL_NPM, 'utf8'))
+
+  it('@cipherstash/eql points repository.url at cipherstash/stack', () => {
+    expect(pkg.repository.url).toBe(`git+${EXPECTED}.git`)
+  })
+
+  it('@cipherstash/eql names its own path from the repo root', () => {
+    expect(pkg.repository.directory).toBe('packages/eql/packages/eql')
+  })
+
+  it('@cipherstash/eql sends bug reports here, not to the old repository', () => {
+    expect(pkg.bugs.url).toBe(`${EXPECTED}/issues`)
+  })
+
+  it('no reference to the old repository remains in package.json', () => {
+    expect(readFileSync(EQL_NPM, 'utf8')).not.toMatch(/encrypt-query-language/)
+  })
+
+  it('eql-bindings names this repository too', () => {
+    const cargo = readFileSync(EQL_BINDINGS_CARGO, 'utf8')
+    expect(cargo).toMatch(
+      /^repository = "https:\/\/github\.com\/cipherstash\/stack"$/m,
+    )
+    expect(cargo).toMatch(
+      /^homepage = "https:\/\/github\.com\/cipherstash\/stack"$/m,
+    )
+    expect(cargo).not.toMatch(/encrypt-query-language/)
+  })
+})