diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3c42e4f..d7a4371 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,33 +8,26 @@ on:
   release:
     types: [created]
 
+# This is a Deno + ReScript project (deno.json, JSR name @hyperpolymath/
+# preference-injector, no package.json) — it publishes to JSR, not npm. The
+# previous npm publish could never run (npm needs a package.json). JSR records
+# build provenance natively from the OIDC token (id-token: write below).
 jobs:
-  publish-npm:
+  publish-jsr:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
-      id-token: write
-
+      id-token: write   # JSR build provenance is minted from this
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Build
-        run: npm run build
-
-      - name: Publish to npm
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          deno-version: v2.x
+      - name: Build (ReScript -> JS)
+        run: deno task build
+      - name: Test
+        run: deno task test
+      - name: Publish to JSR
+        run: deno publish
diff --git a/deno.json b/deno.json
index d8e5a21..a773cf8 100644
--- a/deno.json
+++ b/deno.json
@@ -1,6 +1,7 @@
 {
   "name": "@hyperpolymath/preference-injector",
   "version": "2.0.0",
+  "exports": "./src/rescript/PreferenceInjector.bs.js",
   "tasks": {
     "dev": "deno run --watch --allow-all src/rescript/PreferenceInjector.bs.js",
     "start": "deno run --allow-all src/rescript/PreferenceInjector.bs.js",
@@ -22,7 +23,10 @@
     "pqc-kyber": "npm:pqc-kyber@1.0.0"
   },
   "compilerOptions": {
-    "lib": ["deno.window", "deno.unstable"],
+    "lib": [
+      "deno.window",
+      "deno.unstable"
+    ],
     "strict": true,
     "allowJs": true,
     "checkJs": false
@@ -34,16 +38,34 @@
     "semiColons": true,
     "singleQuote": true,
     "proseWrap": "preserve",
-    "include": ["src/", "tests/", "examples/", "scripts/"],
-    "exclude": ["*.bs.js"]
+    "include": [
+      "src/",
+      "tests/",
+      "examples/",
+      "scripts/"
+    ],
+    "exclude": [
+      "*.bs.js"
+    ]
   },
   "lint": {
     "rules": {
-      "tags": ["recommended"],
-      "exclude": ["no-unused-vars"]
+      "tags": [
+        "recommended"
+      ],
+      "exclude": [
+        "no-unused-vars"
+      ]
     },
-    "include": ["src/", "tests/", "examples/", "scripts/"],
-    "exclude": ["*.bs.js"]
+    "include": [
+      "src/",
+      "tests/",
+      "examples/",
+      "scripts/"
+    ],
+    "exclude": [
+      "*.bs.js"
+    ]
   },
   "lock": false
 }