diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index e5a37d2..0b43836 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,21 @@
-stages: [test]
+stages: [test, publish]
 
 test:
   stage: test
   image: node:22-alpine
   script: [npm ci, npm run build, npm test]
+
+# Publishes to this project's package registry on a version tag (v1.2.3).
+# CI_JOB_TOKEN has write access to the project's own registry, so no stored
+# secret is needed.
+publish:
+  stage: publish
+  image: node:22-alpine
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+  script:
+    - npm ci
+    - npm run build
+    - echo "@extant2000:registry=${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/npm/" > .npmrc
+    - echo "${CI_API_V4_URL#https:}/projects/${CI_PROJECT_ID}/packages/npm/:_authToken=${CI_JOB_TOKEN}" >> .npmrc
+    - npm publish
diff --git a/README.md b/README.md
index a00079f..5822981 100644
--- a/README.md
+++ b/README.md
@@ -112,7 +112,11 @@ canceled status as the cause. The `reports` check is not applicable, because
 
 ## Install
 
+The package is published to the GitLab package registry, so point the
+`@extant2000` scope there first:
+
 ```
+npm config set @extant2000:registry https://gitlab.com/api/v4/packages/npm/
 npm install @extant2000/scope-gate
 ```
 
diff --git a/package.json b/package.json
index 3d012db..00a966d 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,9 @@
     "README.md",
     "LICENSE"
   ],
+  "publishConfig": {
+    "@extant2000:registry": "https://gitlab.com/api/v4/projects/87000507/packages/npm/"
+  },
   "repository": {
     "type": "git",
     "url": "https://gitlab.com/extant2000/scope-gate.git"