diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8bf3d7ea..c02b1f98 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,15 +1,19 @@
 name: CI
 
 on:
+  pull_request:
   push:
     branches:
       - main
-  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   smoke:
-    name: Smoke (${{ matrix.os }})
+    name: Smoke (${{ matrix.os }}, Node ${{ matrix.node-version }})
     runs-on: ${{ matrix.os }}
+
     strategy:
       fail-fast: false
       matrix:
@@ -17,6 +21,11 @@ jobs:
           - ubuntu-latest
           - macos-latest
           - windows-latest
+        node-version:
+          - 24
+        include:
+          - os: ubuntu-latest
+            node-version: 22.19.0
 
     env:
       DEVSPACE_ALLOWED_ROOTS: ${{ github.workspace }}
@@ -25,12 +34,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: ${{ matrix.node-version }}
           cache: npm
 
       - name: Install dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..f77a0f62
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,67 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    if: github.repository == 'Waishnav/devspace'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - name: Ensure tag is on main
+        run: |
+          git fetch origin main:refs/remotes/origin/main --depth=1
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+
+      - name: Verify tag matches package version
+        run: |
+          package_version="$(node -p "require('./package.json').version")"
+          tag_version="${GITHUB_REF_NAME#v}"
+
+          if [ "$package_version" != "$tag_version" ]; then
+            echo "Tag v${tag_version} does not match package.json version ${package_version}."
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+
+      - name: Check package contents
+        run: npm pack --dry-run
+
+      - name: Publish
+        run: npm publish
diff --git a/package-lock.json b/package-lock.json
index 28f65f87..74376968 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,10 @@
       "version": "1.0.3",
       "hasInstallScript": true,
       "license": "MIT",
+      "repository": {
+        "type": "git",
+        "url": "git+https://github.com/Waishnav/devspace.git"
+      },
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.1.0",
         "@anthropic-ai/claude-agent-sdk": "^0.3.200",
diff --git a/package.json b/package.json
index a37581fc..1c5a64a9 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,10 @@
   "name": "@waishnav/devspace",
   "version": "1.0.3",
   "description": "Expose a secure local coding workspace through an MCP server.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Waishnav/devspace.git"
+  },
   "type": "module",
   "main": "dist/server.js",
   "engines": {