diff --git a/CHANGELOG.fork.md b/CHANGELOG.fork.md
index ae603a9e..3e3698d3 100644
--- a/CHANGELOG.fork.md
+++ b/CHANGELOG.fork.md
@@ -10,7 +10,7 @@ Based on upstream [portless v0.15.6](https://github.com/vercel-labs/portless/rel
 
 ### Added
 
-- **JSON output for scripts and agents**: `--json` on `portless list`, `portless get`, `portless doctor`, and `portless service status`. stdout carries only the JSON document, warnings and errors go to stderr, keys are camelCase, and other commands reject the flag. `list --json` returns the routes the proxy serves (live processes and aliases) with their public URLs, and exits 1 when `routes.json` cannot be read or parsed instead of printing an empty list. See the JSON output section of the README. Added in [#6](https://github.com/variableland/portless/pull/6).
+- **JSON output for scripts and agents**: `--json` on `portless list`, `portless get`, `portless doctor`, and `portless service status`. stdout carries only the JSON document, warnings and errors go to stderr, keys are camelCase, and other commands reject the flag. `list --json` returns the routes the proxy serves (live processes and aliases) with their public URLs, and exits 1 when `routes.json` cannot be read or parsed instead of printing an empty list. See the JSON output section of the README. Added in [#6](https://github.com/withvariablelab/portless/pull/6).
 
 ### Changed
 
@@ -24,7 +24,7 @@ Based on upstream [portless v0.15.6](https://github.com/vercel-labs/portless/rel
 
 ### Fixed
 
-- **Wildcard subdomains go to the closest registered parent**: with `--wildcard`, when several registered hostnames are parents of a request (for example `acme.localhost` and `feat-x.acme.localhost` for `tenant.feat-x.acme.localhost`), the closest one now serves it regardless of registration order, and a longer `--path` prefix on a farther parent no longer takes the request from it. If the closest parent has no route for the path, the proxy answers 404 instead of falling through to a farther parent. Upstream issue [vercel-labs/portless#380](https://github.com/vercel-labs/portless/issues/380), fixed in [#4](https://github.com/variableland/portless/pull/4).
+- **Wildcard subdomains go to the closest registered parent**: with `--wildcard`, when several registered hostnames are parents of a request (for example `acme.localhost` and `feat-x.acme.localhost` for `tenant.feat-x.acme.localhost`), the closest one now serves it regardless of registration order, and a longer `--path` prefix on a farther parent no longer takes the request from it. If the closest parent has no route for the path, the proxy answers 404 instead of falling through to a farther parent. Upstream issue [vercel-labs/portless#380](https://github.com/vercel-labs/portless/issues/380), fixed in [#4](https://github.com/withvariablelab/portless/pull/4).
 
 ## 0.0.2
 
diff --git a/NOTICE b/NOTICE
index 52fba044..ff86e98f 100644
--- a/NOTICE
+++ b/NOTICE
@@ -1,6 +1,6 @@
 @variablelab/portless
 Fork maintained by Ricardo Q. Bazan (rcrd) <ricardo@variable.land>
-https://github.com/variableland/portless
+https://github.com/withvariablelab/portless
 
 This product is a fork of portless, created by Vercel Labs.
 
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index aa3bb6d6..10b6ecbd 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -10,14 +10,24 @@ Pushing a new version to `main` is what publishes. There is no separate approval
 
 ## One-time setup
 
-- Publishing uses [npm trusted publishing](https://docs.npmjs.com/trusted-publishers): the `@variablelab/portless` package on npm trusts the `release.yml` workflow of `variableland/portless` running in the `Release` environment, and the job exchanges its GitHub OIDC token for a short-lived npm token. No long-lived token is stored. To re-create the relationship (interactive 2FA):
+- Publishing uses [npm trusted publishing](https://docs.npmjs.com/trusted-publishers): the `@variablelab/portless` package on npm trusts the `release.yml` workflow of `withvariablelab/portless` running in the `Release` environment, and the job exchanges its GitHub OIDC token for a short-lived npm token. No long-lived token is stored.
+- A trusted publisher cannot be edited, only revoked and created again. The old binding names `variableland/portless`, which no longer matches the workflow's OIDC claims, so replace it, revoking first because the `npm trust` docs say a new one fails while another exists (interactive 2FA, npm 11.15.0 or later):
 
   ```bash
-  npm trust github @variablelab/portless --file release.yml --repo variableland/portless --env Release --allow-publish
+  # 1. Find the id of the current binding (it names variableland/portless)
+  npm trust list @variablelab/portless
+
+  # 2. Remove it
+  npm trust revoke --id <id> @variablelab/portless
+
+  # 3. Trust the release workflow of the new repository
+  npm trust github @variablelab/portless --file release.yml --repo withvariablelab/portless --env Release --allow-publish
   ```
 
-- The `Release` GitHub environment exists. Add required reviewers there if you want a manual gate before every publish.
-- The `NPM_TOKEN` secret used for the first release (0.0.1) is no longer read by the workflow. Revoke it on npmjs.com and delete the secret after the first successful OIDC publish.
+  Cut a release right after step 3 (see below) to confirm the new binding works. Use the same three steps if the repository, workflow file, or environment ever changes again.
+
+- The `Release` GitHub environment only accepts deployments from `main` (deployment branches: selected branches, `main`). The trusted publisher is bound to this environment, so a `release.yml` run dispatched from any other branch is rejected before it can request an npm token. Keep that restriction if you recreate the environment, and add required reviewers there if you want a manual gate before every publish.
+- No npm token is stored anywhere. The `NPM_TOKEN` secret used for the first release (0.0.1) is gone from the repository; if a token from that release still exists on npmjs.com, revoke it.
 
 ## Cut a release
 
diff --git a/docs/SYNCING.md b/docs/SYNCING.md
index e0f0c102..aef25d35 100644
--- a/docs/SYNCING.md
+++ b/docs/SYNCING.md
@@ -6,13 +6,14 @@ This fork tracks [vercel-labs/portless](https://github.com/vercel-labs/portless)
 - `fix(proxy): route wildcard subdomains to the closest registered parent` (upstream issue [#380](https://github.com/vercel-labs/portless/issues/380), extended to path prefixes)
 - `chore: rename package to @variablelab/portless` (packaging)
 - fork docs, `CHANGELOG.fork.md`, and the release workflow
+- `chore: move the fork to withvariablelab` (repository URLs)
 
 Everything else should be identical to upstream. Keep it that way: the smaller the fork's diff, the cheaper each sync.
 
 ## One-time setup
 
 ```bash
-git clone git@github.com:variableland/portless.git
+git clone git@github.com:withvariablelab/portless.git
 cd portless
 git remote add upstream https://github.com/vercel-labs/portless.git
 git fetch upstream --tags
diff --git a/packages/portless/package.json b/packages/portless/package.json
index 4412f711..b44090a2 100644
--- a/packages/portless/package.json
+++ b/packages/portless/package.json
@@ -63,12 +63,12 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/variableland/portless.git",
+    "url": "git+https://github.com/withvariablelab/portless.git",
     "directory": "packages/portless"
   },
-  "homepage": "https://github.com/variableland/portless#readme",
+  "homepage": "https://github.com/withvariablelab/portless#readme",
   "bugs": {
-    "url": "https://github.com/variableland/portless/issues"
+    "url": "https://github.com/withvariablelab/portless/issues"
   },
   "devDependencies": {
     "@types/node": "^24.12.4",