diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 9536b55..f0a2614 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -13,13 +13,25 @@ pnpm run build         # Build all entry points to dist/ via vp pack
 pnpm run dev           # Build in watch mode
 pnpm test              # Run tests via vp test
 pnpm run check         # Lint + format + type check via vp check
-pnpm run release       # Bump version, commit, push, tag via bumpp
 ```
 
 Pre-commit hook runs `vp check --fix` on staged files.
 
 After any significant code change, always run `vp check --fix` to ensure lint, formatting, and type checking pass before committing.
 
+## Releasing
+
+Publish a GitHub Release with a `vSEMVER` tag (`v0.0.6`, `v10.1.11`). That triggers
+`.github/workflows/release.yml`, which takes the version from the tag, writes it into
+`package.json` and `src/version.ts` **in the runner only**, builds, and publishes to npm
+via OIDC trusted publishing.
+
+Nothing is committed back — main is protected by rulesets (PR required, signed commits,
+code scanning) with no bypass actors, so the release tag is the version of record. The
+`version` in `package.json` on main is a placeholder and will lag behind npm; keep it in
+step with `src/version.ts` (pinned by `tests/version.test.ts`) and bump both in a normal
+PR whenever you want them to reflect reality.
+
 ## Documentation Rules
 
 After any significant code change, update the following:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3edacb8..fff13ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ on:
     types: [published]
 
 permissions:
-  contents: write
+  contents: read
   id-token: write
 
 jobs:
@@ -54,22 +54,12 @@ jobs:
       - name: Run tests
         run: bun run test
 
-      - name: Bump to the released version
-        env:
-          TAG: ${{ github.event.release.tag_name }}
+      # Runner-local only. main is protected by rulesets with no bypass actors,
+      # so nothing is committed back — the release tag is the version of record.
+      - name: Set version from release tag
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           npm version "$VERSION" --no-git-tag-version --allow-same-version
           printf '/** SDK version string sent with every API request. */\nexport const SDK_VERSION: string = "%s";\n' "$VERSION" > src/version.ts
-          if git diff --quiet; then
-            echo "Already at $VERSION"
-          else
-            git commit -am "chore: release v$VERSION"
-            git push origin HEAD:main
-          fi
-          git tag -f "$TAG"
-          git push -f origin "refs/tags/$TAG"
 
       - name: Build
         run: bun run build