diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..ea93681
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,52 @@
+name: Release
+
+# Publishes @angular-gsap/core to npm via trusted publishing (OIDC):
+# no npm token is stored anywhere. npm verifies this workflow's identity
+# against the trusted publisher registered on the package's npm settings
+# (repo angular-gsap/angular-gsap, workflow release.yml).
+#
+# Flow: run `pnpm nx release --skip-publish` locally (version, changelog,
+# tag, GitHub release); publishing the GitHub release triggers this.
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: pnpm/action-setup@v6
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      # trusted publishing needs npm >= 11.5.1
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm nx build core
+
+      # nx release only writes the version into the local dist manifest,
+      # so a fresh CI build still carries the source version; the release
+      # tag (v1.2.3) is the source of truth here
+      - name: Stamp version from tag
+        run: npm pkg set version="${GITHUB_REF_NAME#v}"
+        working-directory: dist/libs/core
+
+      - name: Publish to npm
+        run: npm publish
+        working-directory: dist/libs/core
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bc58b4b..5ef6dbc 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -37,11 +37,19 @@ pnpm nx run-many -t lint test build   # what CI runs
 
 ## Releasing (maintainers)
 
-Versioning, changelog, and publishing are handled by [`nx release`](https://nx.dev/docs/features/manage-releases):
+Versioning and changelog are handled by [`nx release`](https://nx.dev/docs/features/manage-releases); publishing to npm happens in CI:
 
 ```sh
-pnpm nx release --dry-run   # preview version bump + changelog
-pnpm nx release             # version, changelog, tag, publish to npm
+pnpm nx release --skip-publish --dry-run   # preview version bump + changelog
+pnpm nx release --skip-publish             # version, changelog, tag, GitHub release
 ```
 
-Publishing requires an npm token with access to the `@angular-gsap` scope.
+Publishing the GitHub release triggers `.github/workflows/release.yml`, which
+publishes to npm via [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+(OIDC): no npm token exists anywhere. The trusted publisher is registered on
+the package's npm settings (this repo + `release.yml`).
+
+The very first publish can't use this path (npm only lets you register a
+trusted publisher on a package that already exists), so release 0.1.0 was
+published locally with `pnpm nx release --first-release` and an `npm login`
+session.
diff --git a/libs/core/package.json b/libs/core/package.json
index 3733f5e..7f01b09 100644
--- a/libs/core/package.json
+++ b/libs/core/package.json
@@ -7,6 +7,9 @@
     "gsap": ">=3.12.0"
   },
   "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
   "description": "GSAP integration for Angular — host-scoped, signal-reactive, SSR-safe animation contexts",
   "license": "MIT",
   "repository": {