diff --git a/scripts/publish.mjs b/scripts/publish.mjs
index 77351597..cf01d5fe 100644
--- a/scripts/publish.mjs
+++ b/scripts/publish.mjs
@@ -29,11 +29,12 @@ import {
   statSync,
   existsSync,
 } from 'node:fs';
-import { join } from 'node:path';
+import { join, relative } from 'node:path';
 
 const ROOT = new URL('..', import.meta.url).pathname;
 const INTERNAL_SCOPE = '@agentscript/';
 const PUBLISH_SCOPE = '@sf-agentscript/';
+const REPOSITORY_URL = 'git+https://github.com/salesforce/agentscript.git';
 
 // File extensions whose contents may contain bare module specifiers we need to
 // rewrite. Sourcemaps (.map) embed `sources`/`names` strings as plain JSON, so
@@ -95,6 +96,20 @@ for (const pkg of packages) {
   }
 }
 
+// npm provenance rejects a publish (E422) unless repository.url matches the
+// GitHub repo that built it.
+for (const pkg of packages) {
+  const pkgJsonPath = join(pkg.path, 'package.json');
+  const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
+  if (pkgJson.private) continue;
+  pkgJson.repository = {
+    type: 'git',
+    url: REPOSITORY_URL,
+    directory: relative(ROOT, pkg.path),
+  };
+  writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\n');
+}
+
 // Step 3: Rewrite source-text files inside each package's published dirs.
 // tsc emits source import specifiers verbatim into dist/, and most packages
 // also ship src/, so consumers will see @agentscript/* unless we patch both.