diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d4a622c..f6f80dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,7 @@ jobs:
         run: yarn install
 
       - name: Build the library
-        run: yarn prepack
+        run: yarn build
 
       - name: Run unit tests
         run: yarn test
diff --git a/.github/workflows/publish-to-npm.yml b/.github/workflows/publish-to-npm.yml
new file mode 100644
index 0000000..0703dcc
--- /dev/null
+++ b/.github/workflows/publish-to-npm.yml
@@ -0,0 +1,32 @@
+# Publish a package to npm when a tag starting with "v" is pushed to remote.
+# Currently, only npm supports publishing packages with provenance
+# https://docs.npmjs.com/generating-provenance-statements
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20.x"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install dependencies
+        run: yarn install
+
+      - name: Build package
+        run: yarn build
+
+      - name: Publish package
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+        run: npm publish --provenance --access public
diff --git a/package.json b/package.json
index bfabf61..8f1729f 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
     "test": "vitest -r tests",
     "test:integration": "node tests/test-integration",
     "format": "prettier --write \"{src,tests,playground}/**/*.{js,ts,svelte,md}\" --ignore-path \".gitignore\"",
-    "prepack": "tsc -p tsconfig.build.json"
+    "build": "tsc -p tsconfig.build.json"
   },
   "dependencies": {
     "@rollup/plugin-node-resolve": "^13.2.1",