diff --git a/docs/PRODUCT_UPGRADE_PLAN.md b/docs/PRODUCT_UPGRADE_PLAN.md
index cab7433..c90e6fc 100644
--- a/docs/PRODUCT_UPGRADE_PLAN.md
+++ b/docs/PRODUCT_UPGRADE_PLAN.md
@@ -90,7 +90,7 @@ transparent Python implementation, a strict privacy model, and honest benchmarks
 |---|---|---|
 | No large-scale real-repo benchmark | Can't claim 100k/1M LOC quality | Benchmark tasks §8; recruit public repos |
 | Graph is import/call/ref only | `impact` misses framework wiring | ARCHITECTURE §9 + design doc `specs/2026-06-14-typed-framework-edges-design.md`; implementation behind §8 benchmark |
-| GitHub-only distribution | No `pip install codebase-index` / `uvx` | Distribution tasks §9 |
+| ~~GitHub-only distribution~~ | **PyPI shipped in 1.6.0** — `pip install codebase-index` / `pipx` work; `uvx`/Homebrew still pending | Distribution tasks §9 (uvx/Homebrew) |
 | MCP client docs unverified | Templates may be wrong per client version | Verify against each client, add per-client docs |
 | Single-repo only | No monorepo/fleet context | Out of scope near-term; documented as non-goal |
 | `clean` was a stub vs documented | Doc/reality gap | **Shipped in this pass** — real cache reset + test |
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 2001288..d139f5e 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -71,16 +71,17 @@ original implementation slices. The `(Mx)` tags in
 
 ## M9 — Tests, docs, examples, release ✅
 - Coverage across modules; CLI golden-output tests; perf check on a medium repo.
-- `examples/queries.md`, finalized docs, CHANGELOG, tagged GitHub release (GitHub-only distribution — no PyPI).
+- `examples/queries.md`, finalized docs, CHANGELOG, tagged GitHub release + PyPI publish (PyPI shipped in 1.6.0).
 - **Exit:** `pipx install "git+https://github.com/denfry/codebase-index.git@v1.2.0"` + `init` + ask a question works on a clean machine.
 
 *Shipped: golden-file tests lock CLI `--json` output; a `--runslow` perf smoke test guards
 index/search latency on a synthetic medium repo; coverage is gated (`--cov-fail-under`) in a
 CI matrix (Ubuntu/macOS/Windows x py3.11-3.13). `CHANGELOG.md` tracks releases; a tag-triggered
 release pipeline builds, runs `twine check` + a clean-venv install smoke, and publishes a GitHub
-release with the built artifacts (GitHub-only distribution — no PyPI publish). `pipx install
-"git+https://github.com/denfry/codebase-index.git@v1.2.0"` -> `init` -> `index` -> ask a question is
-verified end-to-end by `scripts/release_smoke.py`.*
+release with the built artifacts, and — as of 1.6.0 — publishes to PyPI via Trusted Publishing
+(OIDC, no stored token; a `workflow_dispatch` run can re-publish an already-tagged version).
+`pip install codebase-index` -> `init` -> `index` -> ask a question is verified end-to-end by
+`scripts/release_smoke.py`.*
 
 ## M10 — MCP bridge ✅ (product roadmap M11)
 - Shipped: a stdio Model Context Protocol server (`codebase-index mcp --root <repo>`, or the