diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml
new file mode 100644
index 0000000..5d9b1ad
--- /dev/null
+++ b/.github/workflows/publish-package.yml
@@ -0,0 +1,43 @@
+# Publishes the package to GitHub Packages (npm.pkg.github.com) whenever the
+# release workflow pushes a semver tag — the tagged commit already carries the
+# matching package.json version. workflow_dispatch allows re-publishing a tag
+# by hand (run it from the tag's ref).
+name: "Release: Publish to GitHub Packages"
+
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Checkout source
+        uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+          registry-url: 'https://npm.pkg.github.com'
+
+      # --ignore-scripts skips the husky prepare hook, which has no place in
+      # CI. The allow-directory override is scoped to this step: npm 11.16's
+      # pack trips the repo's allow-directory policy on the root project
+      # itself even though no directory dependency exists. There is
+      # deliberately no .npmignore: the tarball must match what the git
+      # dependency delivered — the committed vendor/ toolchain included —
+      # so the default pack rules apply. The tarball is ~59 MB.
+      - name: Publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          npm_config_allow_directory: all
+        run: npm publish --ignore-scripts
diff --git a/README.md b/README.md
index 781e7b3..df2bb50 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# @bsu/wp-coding-standards
+# wp-coding-standards
 
 PHP tool binaries for BSU WordPress development. Installed via npm, ships the following tools in `vendor/bin/`:
 
@@ -8,16 +8,33 @@ PHP tool binaries for BSU WordPress development. Installed via npm, ships the fo
 | `phpcbf` | 4.x | PHP Code Beautifier — auto-fixes PHPCS violations |
 | `phpstan` | 1.x | PHPStan — static analysis for type safety and correctness |
 
-## Usage in bsuwp
+## Consuming the Package
 
-These binaries are referenced directly by path in `bsuwp/package.json` scripts:
+Published to GitHub Packages as `@bemidjistate/wp-coding-standards` and
+consumed under the `@bsu/wp-coding-standards` alias, so script paths keep the
+short name:
+
+```json
+"@bsu/wp-coding-standards": "npm:@bemidjistate/wp-coding-standards@3.4.4"
+```
+
+The consumer's `.npmrc` routes the scope to GitHub Packages
+(`@bemidjistate:registry=https://npm.pkg.github.com`); installing requires a
+GitHub personal access token (classic) with `read:packages` in `~/.npmrc`,
+and CI uses its workflow `GITHUB_TOKEN` via the package's Actions access list.
+
+Consumers reference the binaries directly by path in `package.json` scripts:
 
 ```bash
-npm run lint:php        # phpcs via this package
-npm run fix:php         # phpcbf via this package
-npm run analyse:php     # phpstan via this package
+node_modules/@bsu/wp-coding-standards/vendor/bin/phpcs
+node_modules/@bsu/wp-coding-standards/vendor/bin/phpcbf
+node_modules/@bsu/wp-coding-standards/vendor/bin/phpstan
 ```
 
+There is deliberately no `.npmignore`: the published tarball carries the
+committed `vendor/` toolchain — the same content the git dependency
+delivered.
+
 ## Updating
 
 To update tool versions, modify `composer.json` and run `composer update`, then commit the updated `composer.lock` and `vendor/` in a PR to `release`.
diff --git a/package.json b/package.json
index 9d9ef38..3497ba2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
-	"name": "@bsu/wp-coding-standards",
-	"version": "3.4.0",
+	"name": "@bemidjistate/wp-coding-standards",
+	"version": "3.4.4",
 	"description": "PHP tool binaries for BSU WordPress development \u2014 ships PHPCS, WPCS, PHPStan, and PHPUnit",
 	"author": "BSU|NTC Web Services",
 	"license": "Copyright Web Services, Bemidji State University - All Rights Reserved. Unauthorized copying of any files or code in this package, via any medium is strictly prohibited.",
@@ -9,6 +9,9 @@
 		"url": "git+https://github.com/BemidjiState/wp-coding-standards.git"
 	},
 	"homepage": "https://www.bemidjistate.edu",
+	"publishConfig": {
+		"registry": "https://npm.pkg.github.com"
+	},
 	"engines": {
 		"node": ">=24.12",
 		"npm": ">=11.10"