diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 17541be..0c52299 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,9 +1,13 @@
-# DORMANT until Phase 2 (npm publish). Phase 1 distributes via GitHub URL + git
-# tags, so this workflow is disabled by the `if: false` guard below. To go live:
-#   1. Create the `zoldytech` npm org and enable OIDC trusted publishing for this repo.
-#   2. Remove `"private": true` from package.json and uncomment `publishConfig`.
-#   3. Delete the `if: false` line.
-# Publishing is then gated on pushing a `v*` git tag whose version matches package.json.
+# Publishing is gated on pushing a `v*` git tag whose version matches package.json (verified in
+# the `publish` job below — a mismatch fails the job). Requires OIDC trusted publishing to be
+# enabled for this repo on the @zoldytech npm org (npmjs.com -> package settings -> Trusted
+# Publisher -> GitHub Actions -> Zoldytech/javascript -> release.yml).
+#
+# Publish and release-creation are separate jobs, each with least-privilege permissions. The tag
+# itself already exists once pushed (that's what triggers this workflow) regardless of outcome,
+# but the GitHub Release is only created after `publish` succeeds — and lives in its own job so it
+# can be re-run on its own if it fails, without re-attempting `npm publish` (which would fail once
+# the version is already on the registry).
 name: Release
 
 on:
@@ -12,7 +16,6 @@ on:
 
 jobs:
   publish:
-    if: false # DORMANT — see header
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -25,6 +28,24 @@ jobs:
           cache: npm
           registry-url: https://registry.npmjs.org
       - run: npm ci
+      - name: Verify tag matches package.json version
+        run: |
+          PKG_VERSION="v$(node -p "require('./package.json').version")"
+          if [ "$PKG_VERSION" != "${{ github.ref_name }}" ]; then
+            echo "::error::Tag ${{ github.ref_name }} does not match package.json version ($PKG_VERSION)"
+            exit 1
+          fi
       - run: npm run lint
       - run: npm test
       - run: npm publish --provenance --access public
+
+  release:
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the GitHub Release
+    steps:
+      - uses: actions/checkout@v4
+      - run: gh release create "${{ github.ref_name }}" --generate-notes
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
diff --git a/README.md b/README.md
index dcd46e6..4bc9779 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,9 @@
 # @zoldytech/javascript
 
+[![npm version](https://img.shields.io/npm/v/@zoldytech/javascript.svg)](https://npmjs.com/package/@zoldytech/javascript)
+[![npm downloads](https://img.shields.io/npm/dm/@zoldytech/javascript.svg)](https://npmjs.com/package/@zoldytech/javascript)
+[![CI](https://img.shields.io/github/actions/workflow/status/Zoldytech/javascript/ci.yml?branch=main)](https://github.com/Zoldytech/javascript/actions/workflows/ci.yml)
+
 A general-purpose ESLint **house style**, built on [`@antfu/eslint-config`](https://github.com/antfu/eslint-config)
 and made **SonarQube-compatible**: local ESLint mirrors what the SonarQube gate flags, so you fix
 Sonar issues before they reach CI. Five stack presets — **plain JS/TS**, **React + Vite**,
@@ -26,10 +30,8 @@ Sonar issues before they reach CI. Five stack presets — **plain JS/TS**, **Rea
 
 ## Install
 
-Distributed via GitHub URL, pinned to a tag (no build step runs on install — raw ESM):
-
 ```bash
-npm i -D "github:zoldytech/javascript#0.1.2"
+npm i -D @zoldytech/javascript
 ```
 
 ## Usage
diff --git a/package.json b/package.json
index d164126..68d151b 100644
--- a/package.json
+++ b/package.json
@@ -1,10 +1,20 @@
 {
   "name": "@zoldytech/javascript",
   "type": "module",
-  "version": "0.1.3",
-  "private": true,
+  "version": "0.1.4",
   "description": "Zoldytech's JavaScript/TypeScript standards: SonarQube-compatible ESLint presets (Next.js, NestJS, React+Vite, plain JS/TS) plus shared Prettier and tsconfig configs.",
   "license": "MIT",
+  "homepage": "https://github.com/Zoldytech/javascript#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Zoldytech/javascript.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Zoldytech/javascript/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
   "prettier": "./prettier/prettierrc.json",
   "exports": {
     "./eslint": "./eslint/index.js",