diff --git a/.github/workflows/publish-on-tag.yml b/.github/workflows/publish-on-tag.yml
new file mode 100644
index 0000000..9aa0a42
--- /dev/null
+++ b/.github/workflows/publish-on-tag.yml
@@ -0,0 +1,38 @@
+name: publish-on-tag
+
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # Required for OIDC (npm Trusted Publishing)
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          cache: npm
+          node-version-file: '.nvmrc'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      - name: Publish
+        run: npm publish --provenance --access public
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..54c6511
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+v24
diff --git a/README.md b/README.md
index cfe3d01..3274921 100644
--- a/README.md
+++ b/README.md
@@ -86,8 +86,24 @@ project illustrating how to use the plugin in practice.
 
 ## Publishing
 
-**Googlers:** We use [go/wombat-dressing-room](http://go/wombat-dressing-room)
-for publishing.
+The package is published to npm by the
+[`publish-on-tag`](.github/workflows/publish-on-tag.yml) GitHub Actions
+workflow, which uses npm [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+(no npm tokens involved) and generates
+[provenance attestations](https://docs.npmjs.com/generating-provenance-statements).
+
+To publish a new version:
+
+1. Bump the `version` in `package.json` and land that change on `main`.
+2. Tag the release commit and push the tag:
+
+   ```sh
+   git tag v1.2.3
+   git push origin v1.2.3
+   ```
+
+Pushing the tag triggers the workflow, which builds and tests the package and
+then runs `npm publish`.
 
 ## License
 
diff --git a/package.json b/package.json
index 8314ef3..81763cb 100644
--- a/package.json
+++ b/package.json
@@ -71,8 +71,5 @@
     "typescript": "^5.7.3",
     "vite": "^8.0.16",
     "vitest": "^4.1.8"
-  },
-  "publishConfig": {
-    "registry": "https://wombat-dressing-room.appspot.com"
   }
 }
diff --git a/test/index.test.ts b/test/index.test.ts
index 2eae9c0..3a19f51 100644
--- a/test/index.test.ts
+++ b/test/index.test.ts
@@ -145,6 +145,10 @@ describe('#VitePluginDevToolsJson', () => {
         server: {
           port,
           host: true,
+          // Disable Vite's built-in host validation, which (depending on the
+          // Vite version) runs before plugin middlewares and would answer this
+          // request itself, so that the plugin's own check is exercised.
+          allowedHosts: true,
         },
       });
 
diff --git a/tsconfig.json b/tsconfig.json
index fcc5f85..dcc8493 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -7,7 +7,7 @@
         "noImplicitAny": true,
         "noUnusedLocals": true,
         "module": "ESNext",
-        "moduleResolution": "node",
+        "moduleResolution": "bundler",
         "sourceMap": false,
         "outDir": "dist",
         "target": "ES2020",