diff --git a/.ci/publish.sh b/.ci/publish.sh
new file mode 100644
index 0000000..8f152c0
--- /dev/null
+++ b/.ci/publish.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -eu
+
+echo "Publishing release $TAG"
+
+echo //registry.npmjs.org/:_authToken=$NPM_TOKEN > ~/.npmrc
+npm run publish
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index b28ac10..5793ef2 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -26,7 +26,8 @@ jobs:
         with:
           node-version: 20
           registry-url: https://registry.npmjs.org/
-      - run: npm ci
-      - run: npm publish
-        env:
+      - env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+        run: |
+          npm ci
+          bash .ci/publish.sh
diff --git a/package.json b/package.json
index cd53685..4179942 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,8 @@
     "build": "babel src/templating --out-dir lib",
     "lint": "eslint index.js src/**/*.js",
     "lint:fix": "npm run lint -- --fix",
-    "watch": "nodemon --watch src --exec 'npm run lint && npm run build'"
+    "watch": "nodemon --watch src --exec 'npm run lint && npm run build'",
+    "publish": "npm publish --access public"
   },
   "preferGlobal": true,
   "bin": {