diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml
index 61b0d67..44e5c3b 100644
--- a/.github/workflows/release-prepare.yml
+++ b/.github/workflows/release-prepare.yml
@@ -80,14 +80,17 @@ jobs:
                   level=$(node scripts/changelog/index.ts bump-level --override "$BUMP_LEVEL")
                   echo "level=$level" >> "$GITHUB_OUTPUT"
 
-            - name: Bump package.json version
+            # Bumps the library project's own package.json, not the workspace root's: ng-packagr
+            # publishes projects/template-lib-angular/package.json's version, and the two have been
+            # independent since the library was scaffolded (root stayed at 0.0.0).
+            - name: Bump library package.json version
               id: version
               shell: bash
               env:
                   LEVEL: ${{ steps.bump-level.outputs.level }}
               run: |
-                  pnpm version "$LEVEL" --no-git-tag-version
-                  version=$(node -p "require('./package.json').version")
+                  pnpm --dir projects/template-lib-angular version "$LEVEL" --no-git-tag-version
+                  version=$(node -p "require('./projects/template-lib-angular/package.json').version")
                   echo "version=$version" >> "$GITHUB_OUTPUT"
 
             - name: Update CHANGELOG.md
@@ -111,7 +114,7 @@ jobs:
                       --arg repo "$REPO" \
                       --arg headOid "$head_oid" \
                       --arg message "chore(release): $VERSION" \
-                      --rawfile packageJson package.json \
+                      --rawfile libraryPackageJson projects/template-lib-angular/package.json \
                       --rawfile changelog CHANGELOG.md \
                       '{
                           query: "mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid } } }",
@@ -122,7 +125,7 @@ jobs:
                                   expectedHeadOid: $headOid,
                                   fileChanges: {
                                       additions: [
-                                          { path: "package.json", contents: ($packageJson | @base64) },
+                                          { path: "projects/template-lib-angular/package.json", contents: ($libraryPackageJson | @base64) },
                                           { path: "CHANGELOG.md", contents: ($changelog | @base64) }
                                       ]
                                   }
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index ee50092..aa39484 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -17,8 +17,6 @@ jobs:
             contents: read
         outputs:
             version: ${{ steps.version.outputs.version }}
-            major: ${{ steps.version.outputs.major }}
-            major-minor: ${{ steps.version.outputs.major-minor }}
         steps:
             - name: Checkout repo
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -35,13 +33,8 @@ jobs:
                   REF_NAME: ${{ github.ref_name }}
               run: |
                   version="${REF_NAME#v}"
-                  major="${version%%.*}"
-                  rest="${version#*.}"
-                  minor="${rest%%.*}"
 
                   echo "version=$version" >> "$GITHUB_OUTPUT"
-                  echo "major=$major" >> "$GITHUB_OUTPUT"
-                  echo "major-minor=$major.$minor" >> "$GITHUB_OUTPUT"
 
             - name: Extract release notes
               shell: bash
@@ -65,3 +58,44 @@ jobs:
                   GH_TOKEN: ${{ steps.app-token.outputs.token }}
                   VERSION: ${{ steps.version.outputs.version }}
               run: gh release create "v$VERSION" --notes-file release-notes.md --discussion-category announcements
+
+    publish:
+        name: Publish to npm
+        runs-on: ubuntu-22.04
+        timeout-minutes: 5
+        permissions:
+            id-token: write
+            contents: read
+        steps:
+            - name: Checkout repo
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  persist-credentials: false
+
+            - name: Setup Pnpm
+              uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+            - name: Setup Node.js
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+              with:
+                  node-version-file: 'package.json'
+                  registry-url: 'https://registry.npmjs.org'
+                  scope: '@dnd-mapp'
+
+            - name: Install dependencies
+              shell: bash
+              run: pnpm i
+
+            - name: Build library
+              shell: bash
+              run: pnpm build
+
+            # Trusted Publishing exchanges the job's OIDC token (`id-token: write` above) for a
+            # short-lived publish credential; no NPM_TOKEN secret is involved. `npm stage publish`
+            # (rather than `npm publish`) uploads to the stage queue and doesn't require 2FA, so it
+            # completes from an unattended CI job; a maintainer separately approves it with 2FA
+            # (CLI or npmjs.com) before it becomes the installable version.
+            - name: Publish to npm stage queue
+              shell: bash
+              working-directory: dist/template-lib-angular
+              run: npm stage publish