diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..376239d
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,55 @@
+name: Publish
+
+# Tag-triggered publish to npm. A pushed v* tag starts the run, but the
+# publish step is gated on maintainer sign-off through the npm-publish
+# environment and authenticates with that environment's NPM_TOKEN secret.
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    # Required-reviewer environment: a pushed tag queues the publish until a
+    # maintainer approves the run, and the environment scopes the NPM_TOKEN
+    # secret so no other workflow can read it. id-token stays enabled for
+    # npm provenance attestation.
+    environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+          cache: yarn
+
+      - name: Upgrade npm
+        # Trusted publishing (OIDC) needs npm >= 11.5.1; the Node 22 image
+        # ships npm 10.x.
+        run: npm install -g npm@latest
+
+      - name: Verify tag matches package version
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match package.json version $version" >&2
+            exit 1
+          fi
+
+      - name: Install
+        run: yarn install --frozen-lockfile
+
+      - name: Build
+        run: yarn run build
+
+      - name: Test
+        run: yarn run test
+
+      - name: Publish
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/README.md b/README.md
index 9652e0a..2220d94 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ The focus of VeRT is on the better compatibility than the performance, so it can
 ## Requirement
 
 - WebAssembly binary with exported memory
-- Nodejs v16 or higher (JavaScript runtime with WebAssembly BigInt support)
+- Nodejs v20 or higher (JavaScript runtime with WebAssembly BigInt support)
 
 ## Chain compatibility
 
diff --git a/package.json b/package.json
index 3f6713c..c1613c3 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,9 @@
   "description": "Testing library for Antelope smart contracts, with per-chain host function parity",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "engines": {
+    "node": ">=20"
+  },
   "files": [
     "dist",
     "src"
@@ -14,7 +17,8 @@
     "build-web": "webpack",
     "start": "node dist/index",
     "test": "mocha src/**/*.spec.ts -r ts-node/register && yarn --cwd examples",
-    "prepublish": "npm run test && npm run build"
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run test"
   },
   "author": "Jeeyong Um <conr2d@gmail.com>",
   "license": "MIT",
diff --git a/tsconfig.json b/tsconfig.json
index 17380bf..010497d 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -11,5 +11,5 @@
     "experimentalDecorators": true
   },
   "lib": ["es2020"],
-  "exclude": [ "examples/**/*" ]
+  "exclude": [ "examples/**/*", "src/**/tests/**", "**/*.spec.ts" ]
 }