diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..3482125
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,24 @@
+name: publish
+# GitHub Release를 publish하면 npm에 배포한다. NPM_TOKEN 시크릿 필요.
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write # npm provenance(OIDC)에 필요
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+      - run: npm ci
+      - run: npm test
+      - run: npm publish --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/package.json b/package.json
index 7b30983..488d638 100644
--- a/package.json
+++ b/package.json
@@ -9,6 +9,9 @@
   "files": [
     "dist"
   ],
+  "publishConfig": {
+    "access": "public"
+  },
   "engines": {
     "node": ">=20"
   },
@@ -17,13 +20,23 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "dev": "tsx src/cli/index.ts",
+    "prepublishOnly": "npm run build",
     "prepare": "husky"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/followingseas/pilot.git"
   },
-  "keywords": [],
+  "keywords": [
+    "rutter",
+    "ai-agents",
+    "coding-agent",
+    "mcp",
+    "cli",
+    "conventions",
+    "policy",
+    "claude-code"
+  ],
   "author": "",
   "license": "MIT",
   "bugs": {