diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 953c62d..60a9476 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 env:
   CURL_VERSION: 8.19.0
@@ -257,3 +258,47 @@ jobs:
               release/tweeta-darwin-x64 \
               release/tweeta-darwin-arm64
           fi
+
+  publish-npm:
+    needs:
+      - metadata
+      - release
+    if: github.ref_name == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: https://registry.npmjs.org
+
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+
+      - name: Prepare npm package
+        env:
+          VERSION: ${{ needs.metadata.outputs.version }}
+        run: |
+          set -eu
+          rm -rf npm-binaries
+          mkdir -p npm-binaries
+          find dist -type f -name 'tweeta-*' -exec cp {} npm-binaries/ \;
+          for target in linux-x64 linux-arm64 darwin-x64 darwin-arm64; do
+            test -f "npm-binaries/tweeta-${target}"
+          done
+          chmod 755 npm-binaries/tweeta-*
+          npm version --no-git-tag-version "${VERSION}"
+          npm pack --dry-run
+
+      - name: Publish npm package
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --provenance
diff --git a/README.md b/README.md
index 7e6331e..daade70 100644
--- a/README.md
+++ b/README.md
@@ -17,12 +17,12 @@ make
 Install from npm once published:
 
 ```sh
-npm install -g tweeta-cli
+npm install -g tweetapus
 ```
 
 The npm package contains prebuilt static `tweeta` binaries, so installation on the end user's machine does not compile anything and does not fetch additional artifacts.
 
-The package is not published yet. The npm packaging in this repository is there so it can be published later from CI.
+The package is published from CI after a successful default-branch release.
 
 When the package is published, it is intended to be assembled before publish by downloading release assets from `https://github.com/tweetapus/tweeta-cli/releases/latest`. It expects assets named:
 
diff --git a/package.json b/package.json
index ebb0733..295921b 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "tweeta-cli",
+  "name": "tweetapus",
   "version": "0.1.0",
   "description": "CLI wrapper for the Tweetapus tweeta client",
   "license": "AGPL-3.0-or-later",