diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e5a37d2..0b43836 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,21 @@
-stages: [test]
+stages: [test, publish]
 
 test:
   stage: test
   image: node:22-alpine
   script: [npm ci, npm run build, npm test]
+
+# Publishes to this project's package registry on a version tag (v1.2.3).
+# CI_JOB_TOKEN has write access to the project's own registry, so no stored
+# secret is needed.
+publish:
+  stage: publish
+  image: node:22-alpine
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+  script:
+    - npm ci
+    - npm run build
+    - echo "@extant2000:registry=${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/npm/" > .npmrc
+    - echo "${CI_API_V4_URL#https:}/projects/${CI_PROJECT_ID}/packages/npm/:_authToken=${CI_JOB_TOKEN}" >> .npmrc
+    - npm publish
diff --git a/package.json b/package.json
index f8c6d22..3d1e7d1 100644
--- a/package.json
+++ b/package.json
@@ -39,5 +39,8 @@
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
   },
-  "module": "./dist/index.js"
+  "module": "./dist/index.js",
+  "publishConfig": {
+    "@extant2000:registry": "https://gitlab.com/api/v4/projects/87000311/packages/npm/"
+  }
 }