diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index da0648d..85c368a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,6 +22,33 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.14
-      - run: bun install --frozen-lockfile
-      - run: bun run check
-      - run: npm publish --access public --provenance
+      - name: Use current provenance-capable npm
+        run: npm install --global npm@12.0.1
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Validate release metadata
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          node -e 'const p = require("./package.json"); if (p.name !== "@receiptprotocol/sdk") throw new Error("Unexpected package name"); if (`v${p.version}` !== process.env.RELEASE_TAG) throw new Error("Release tag must match package version"); if (p.repository?.url !== "git+https://github.com/Receiptprotocol/receipt-sdk.git") throw new Error("Repository URL does not match provenance source")'
+      - name: Typecheck
+        run: bun run typecheck
+      - name: Lint
+        run: bun run tsc --noEmit --noUnusedLocals --noUnusedParameters -p tsconfig.json
+      - name: Test
+        run: bun run test
+      - name: Build
+        run: bun run build
+      - name: Inspect package tarball
+        run: npm pack --dry-run
+      - name: Verify npm authentication
+        run: |
+          test -n "${NODE_AUTH_TOKEN:-}"
+          npm_identity="$(npm whoami --registry=https://registry.npmjs.org)"
+          test "$npm_identity" = "jasonsmall"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Publish public alpha with provenance
+        run: npm publish --provenance --access public --tag alpha
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}