diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
new file mode 100644
index 0000000..e9b9f61
--- /dev/null
+++ b/.github/workflows/cd.yml
@@ -0,0 +1,60 @@
+name: CD
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+  release:
+    types:
+      - published
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_COLOR: 3
+
+jobs:
+  dist:
+    name: Distribution build
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      # v3 ships Twine 7, which understands packaging metadata 2.4/2.5 — what a
+      # PEP 639 SPDX license declaration produces. v2 bundles Twine 6 and fails
+      # `twine check --strict`. v3 no longer force-tags majors, so pin in full.
+      - uses: hynek/build-and-inspect-python-package@v3.0.1
+
+  publish:
+    needs: [dist]
+    name: Publish to PyPI
+    environment: pypi
+    permissions:
+      # Trusted publishing: PyPI verifies this workflow's OIDC identity, so no
+      # API token is stored anywhere. Requires a pending publisher configured on
+      # PyPI for this project before the first release.
+      id-token: write
+      attestations: write
+      contents: read
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release' && github.event.action == 'published'
+
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: Packages
+          path: dist
+
+      - name: Generate artifact attestation for sdist and wheel
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: "dist/*"
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.gitignore b/.gitignore
index 7e81c99..a6617e6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,30 +1,13 @@
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
+# Generated by the hatch-vcs build hook — the git tag is the source of truth
+src/**/_version.py
 
-# Distribution / packaging
-dist/
+# Build artifacts
 build/
+dist/
 *.egg-info/
-*.egg
-
-# Virtual environments
+__pycache__/
+*.py[cod]
 .venv/
-venv/
-ENV/
-
-# IDE
-.idea/
-.vscode/
-*.swp
-*.swo
-
-# Testing
 .pytest_cache/
-.coverage
-htmlcov/
-
-# OS
-.DS_Store
-Thumbs.db
+.ruff_cache/
+.mypy_cache/
diff --git a/pyproject.toml b/pyproject.toml
index d998733..ce46961 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,14 +1,15 @@
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling>=1.27", "hatch-vcs"]
 build-backend = "hatchling.build"
 
 [project]
 name = "dj-figpack-codecs"
-version = "0.2.0"
 description = "DataJoint codec for storing figpack visualizations in schema-addressed OAS"
 readme = "README.md"
-license = { file = "LICENSE" }
+license = "Apache-2.0"
+license-files = ["LICENSE"]
 requires-python = ">=3.10"
+dynamic = ["version"]
 authors = [
     { name = "DataJoint", email = "info@datajoint.com" }
 ]
@@ -16,11 +17,12 @@ keywords = ["datajoint", "figpack", "visualization", "neuroscience"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Science/Research",
-    "License :: OSI Approved :: Apache Software License",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Scientific/Engineering",
 ]
 
@@ -65,3 +67,12 @@ addopts = "-v"
 [tool.black]
 line-length = 100
 target-version = ["py310"]
+
+# The git tag is the single source of truth for the version — mirrors dj-zarr-codecs.
+# The build hook writes _version.py, which the package imports, so nothing declares a
+# version twice and nothing needs bumping in a pull request.
+[tool.hatch.version]
+source = "vcs"
+
+[tool.hatch.build.hooks.vcs]
+version-file = "src/dj_figpack_codecs/_version.py"
diff --git a/src/dj_figpack_codecs/__init__.py b/src/dj_figpack_codecs/__init__.py
index 2f332c5..587e2c8 100644
--- a/src/dj_figpack_codecs/__init__.py
+++ b/src/dj_figpack_codecs/__init__.py
@@ -41,5 +41,6 @@ def make(self, key):
 
 from .codec import FigpackCodec
 from .ref import FigpackRef
+from ._version import version as __version__
 
-__all__ = ["FigpackCodec", "FigpackRef", "__version__"]
+__all__ = ["__version__", "FigpackCodec", "FigpackRef", "__version__"]