diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..d96fad0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Node ${{ matrix.node }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [20, 22, 24]
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+      - run: npm pack --dry-run
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index bdb15ed..6222898 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -9,9 +9,14 @@ permissions:
   contents: read
   id-token: write
 
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
 
@@ -19,6 +24,7 @@ jobs:
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
+          cache: npm
 
       - name: Verify tag matches package version
         run: |
@@ -32,4 +38,20 @@ jobs:
       - run: npm run build
       - run: npm test
       - run: npm pack --dry-run
-      - run: npm publish
+
+      - name: Publish (trusted publishing, idempotent)
+        # Tokenless: configure this workflow as the package's trusted publisher
+        # on npmjs.com; npm exchanges the job's OIDC identity (id-token: write)
+        # for short-lived credentials. Provenance is attached automatically.
+        # Requires npm >= 11.5.1 (Node 24 bundles npm 11).
+        run: |
+          set -euo pipefail
+          name=$(node -p "require('./package.json').name")
+          version=$(node -p "require('./package.json').version")
+          # Re-running the workflow for an already-published tag should be a
+          # no-op, not a 409 failure.
+          if npm view "${name}@${version}" version >/dev/null 2>&1; then
+            echo "${name}@${version} already published — skipping"
+          else
+            npm publish
+          fi