diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d308b11..21eeffa 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -43,5 +43,13 @@ jobs:
           actual=$(node -p "require('./$dir/package.json').version")
           test "$actual" = "$version" || { echo "$dir is $actual, tag says $version"; exit 1; }
           echo "dir=$dir" >> "$GITHUB_OUTPUT"
-      - run: npm publish
+          # A package's first version is published by hand (npm trusts a workflow only
+          # for a package that exists); its tag then only records it.
+          name=$(node -p "require('./$dir/package.json').name")
+          if npm view "$name@$version" version >/dev/null 2>&1; then
+            echo "$name@$version is already on npm"
+            echo "published=true" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.pkg.outputs.published != 'true'
+        run: npm publish
         working-directory: ${{ steps.pkg.outputs.dir }}
diff --git a/README.md b/README.md
index d546754..7075f19 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,9 @@ git tag -a dsh-plugin-v0.2.1 -m "dsh-plugin 0.2.1"
 git push origin dsh-plugin-v0.2.1
 ```
 
-The `publish` workflow runs the tests and publishes that package to npm with provenance. Tags are immutable once pushed.
+The `publish` workflow runs the tests and, once approved, publishes that package to npm with provenance. Tags are immutable once pushed.
+
+A new package's first version is published by hand, since npm trusts a workflow only for a package that already exists: `npm publish` in its directory, then `npm trust github <name> --file publish.yml --repo stuga-dev/agent-plugins --env publish --allow-publish` and `npm access set mfa=publish <name>`. Its tag then only records the release; the workflow sees the version on npm and skips publishing.
 
 ## License