diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4b09255
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,21 @@
+name: ci
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  test:
+    # ci-workflows python-ci @ main
+    uses: img2threejs/ci-workflows/.github/workflows/python-ci.yml@4b7a0612d2c52815792124a18ae3f9032a4f0a88
+    with:
+      python-version: '3.12'
+      test-command: |
+        pkg="$(node -p 'require("./package.json").version')"
+        plg="$(node -p 'require("./plugin.json").version')"
+        if [ "$pkg" != "$plg" ]; then
+          echo "version mismatch: package.json=$pkg plugin.json=$plg"
+          exit 1
+        fi
+        python3 -m unittest discover -s tests
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..642f522
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,22 @@
+name: publish
+on:
+  push:
+    tags: ['v*']
+permissions:
+  contents: read
+jobs:
+  publish:
+    # ci-workflows npm-publish (feat/reusable-npm-publish); re-pin to the merged main SHA once img2threejs/ci-workflows#2 lands
+    uses: img2threejs/ci-workflows/.github/workflows/npm-publish.yml@27da7a68505591492cb4ef7358968890c6e39844
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      tag: ${{ github.ref_name }}
+      version-file: plugin.json
+      node-version: '24'
+      python-version: '3.12'
+      test-command: |
+        python3 -m unittest discover -s tests
+    secrets:
+      npm-token: ${{ secrets.NPM_TOKEN }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d4430dc..1b19d87 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -92,6 +92,17 @@ the line after it, or use the exit code — nothing a test prints can forge that
 
 This repository ships no Counter-Strike 2 assets and must never start. See [SECURITY.md](SECURITY.md).
 
+## Publishing to npm
+
+CI and publishing run through the org's shared [`img2threejs/ci-workflows`](https://github.com/img2threejs/ci-workflows) reusable workflows; this repo owns only its triggers and its test command.
+
+1. Bump the version in **both** `plugin.json` and `package.json` — the `ci` workflow's version-sync check fails the build if they disagree.
+2. Update `CHANGELOG.md`.
+3. Commit the bump.
+4. Tag the commit `vX.Y.Z` (matching the new version) and push the tag. A prerelease tag (`v1.2.3-beta.1`) publishes under the matching npm dist-tag (`beta`); a stable tag publishes under `latest`.
+5. The shared `npm-publish.yml` workflow re-validates the tag against `package.json` and `plugin.json`, runs this repo's tests in a job with no access to the publish credential, and runs `npm publish --provenance` using the org's `NPM_TOKEN` secret (a granular npm automation token with publish rights on the `@img2threejs` scope, configured once at the org or repo level — no per-repo trusted-publisher setup needed). Re-pushing a tag whose version is already on the registry is a no-op, not a failure.
+6. Workflow references in `.github/workflows/` are pinned to a specific `ci-workflows` commit SHA, per that repo's pinning policy.
+
 ## License
 
 By contributing you agree your contributions are licensed under Apache-2.0, the same as this project.
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..28e78e8
--- /dev/null
+++ b/package.json
@@ -0,0 +1,28 @@
+{
+  "name": "@img2threejs/plugin-cs2",
+  "version": "0.1.2",
+  "description": "Counter-Strike 2 weapon and glove skin reconstruction: intake contract, authoritative classification, finish/material recipes, and a blocking review gate.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/img2threejs/plugin-cs2.git"
+  },
+  "files": [
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "SECURITY.md",
+    "SKILL.md",
+    "docs",
+    "domain.json",
+    "gates.json",
+    "grimoire",
+    "plugin.json",
+    "skills",
+    "spec_search_profile.json",
+    "steps.json",
+    "tools"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}