diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
new file mode 100644
index 0000000..eb69f9d
--- /dev/null
+++ b/.github/workflows/npm-publish.yml
@@ -0,0 +1,37 @@
+name: Publish package to npm
+
+on:
+  release:
+    types: [created]
+
+concurrency:
+  group: "${{ github.workflow }} ✨ ${{ github.ref }}"
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "lts/*"
+          registry-url: "https://registry.npmjs.org"
+
+      # npm stage publish requires npm >= 11.15.0
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
+      - name: Stage publish to npm
+        run: npm stage publish
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..c1e4cca
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,7 @@
+allow-file=none
+allow-remote=none
+allow-git=none
+allow-directory=none
+
+min-release-age=7
+save-exact=false
\ No newline at end of file
diff --git a/package.json b/package.json
index 5f60e5f..3ad7ee6 100644
--- a/package.json
+++ b/package.json
@@ -29,6 +29,9 @@
     "README.md",
     "index.js"
   ],
+  "publishConfig": {
+    "provenance": true
+  },
   "engines": {
     "node": ">= 0.8.0"
   },