diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..a9e0a73
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,60 @@
+# Publish to PyPI on a version tag, via PyPI Trusted Publishing (OIDC) — no API
+# token stored anywhere. The published version is whatever pyproject.toml says;
+# the tag (v0.1.0, ...) is just the trigger — and is checked against it below.
+# Bump pyproject.toml's version and _version.py to match before tagging.
+#
+# One-time PyPI setup (Trusted Publisher / "pending publisher" for a new project):
+#   PyPI Project Name: isms-sdk
+#   Owner:             unidoc
+#   Repository name:   isms-python
+#   Workflow name:     release.yml
+#   Environment name:  pypi
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  # tests.yml only runs on push-to-master / PRs, never on tag pushes — so gate the
+  # release on lint+tests passing on this exact tagged commit.
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: pip install --quiet -e ".[dev]"
+      - run: ruff check src tests
+      - run: pytest -q
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # required for PyPI Trusted Publishing (OIDC)
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Verify tag matches project version
+        run: |
+          tag_version="${GITHUB_REF_NAME#v}"
+          project_version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')"
+          if [ "$tag_version" != "$project_version" ]; then
+            echo "::error::Tag v$tag_version does not match pyproject.toml version $project_version"
+            exit 1
+          fi
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --quiet build
+          python -m build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/README.md b/README.md
index d11a36d..fa44697 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,13 @@ custom dashboards without touching the web UI.
 ## Install
 
 ```sh
-pip install isms
+pip install isms-sdk
+```
+
+The distribution is `isms-sdk`; you import it as `isms`:
+
+```python
+from isms import IsmsClient
 ```
 
 Requires Python 3.10 or later.
diff --git a/pyproject.toml b/pyproject.toml
index 1365b4f..7954953 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,7 +3,7 @@ requires = ["hatchling>=1.24"]
 build-backend = "hatchling.build"
 
 [project]
-name = "isms"
+name = "isms-sdk"
 version = "0.1.0"
 description = "Official Python client for the ISMS platform (isms.sh)"
 readme = "README.md"