diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
new file mode 100644
index 0000000..80f0b1b
--- /dev/null
+++ b/.github/workflows/npm-publish.yml
@@ -0,0 +1,95 @@
+name: Publish to npm
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: npm-publish-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    defaults:
+      run:
+        working-directory: TypeScript
+
+    steps:
+      - name: Check out the release tag
+        uses: actions/checkout@v7
+        with:
+          ref: refs/tags/${{ github.event.release.tag_name }}
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - name: Validate the release version
+        id: release
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          IS_PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from 'node:fs';
+
+          const { version } = JSON.parse(readFileSync('package.json', 'utf8'));
+          const { RELEASE_TAG, IS_PRERELEASE, GITHUB_OUTPUT } = process.env;
+          if (RELEASE_TAG !== version && RELEASE_TAG !== `v${version}`) {
+            throw new Error(`Release tag ${RELEASE_TAG} must match package.json version ${version} (with an optional v prefix).`);
+          }
+
+          const isPrereleaseVersion = version.split('+')[0].includes('-');
+          if (IS_PRERELEASE === 'true' && !isPrereleaseVersion) {
+            throw new Error('GitHub prereleases must use a prerelease package version, such as 3.2.0-beta.1.');
+          }
+
+          const distTag = isPrereleaseVersion ? 'next' : 'latest';
+          appendFileSync(GITHUB_OUTPUT, `dist-tag=${distTag}\n`);
+          console.log(`Publishing @arcweave/arcscript@${version} with npm tag ${distTag}.`);
+          NODE
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          package_json_file: TypeScript/package.json
+
+      - name: Set up Java for ANTLR
+        uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Generate parsers
+        working-directory: .
+        run: sh generate.sh
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build package
+        run: pnpm run build
+
+      - name: Run tests
+        run: pnpm test --run
+
+      # Trusted publishing requires npm 11.5.1 or newer.
+      - name: Update npm
+        run: npm install --global npm@11
+
+      - name: Publish package
+        env:
+          NPM_DIST_TAG: ${{ steps.release.outputs.dist-tag }}
+        run: npm publish --access public --provenance --tag "$NPM_DIST_TAG"
diff --git a/TypeScript/README.md b/TypeScript/README.md
index 699071e..4e4bd1d 100644
--- a/TypeScript/README.md
+++ b/TypeScript/README.md
@@ -278,6 +278,8 @@ pnpm lint
 
 The build writes compiled files and declarations to `dist/`.
 
+New GitHub releases are automatically published to [npmjs.com](https://www.npmjs.com/package/@arcweave/arcscript).
+
 ## Contributing
 
 1. Fork the repository.