diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 28a8b41..f7b4fd0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,3 +23,20 @@ jobs:
       - run: pnpm changeset publish
         env:
           NPM_CONFIG_PROVENANCE: true
+      - name: Push git tags
+        run: git push origin --tags
+      - name: Derive version
+        id: ver
+        run: echo "v=v$(node -p "require('./packages/codec/package.json').version")" >> "$GITHUB_OUTPUT"
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
+        with:
+          tag_name: ${{ steps.ver.outputs.v }}
+          generate_release_notes: true
+      - name: Obtain crates.io OIDC token
+        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe  # v1.0.4
+        id: crates-io-auth
+      - name: Publish to crates.io
+        run: cargo publish -p void-layer-codec --manifest-path packages/codec/Cargo.toml
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
diff --git a/README.md b/README.md
index 8a40a1d..bdbd05f 100644
--- a/README.md
+++ b/README.md
@@ -6,15 +6,15 @@ Canonical Invoice codec — TLV + Brotli wire format. v1 schema LOCKED forever.
 
 ## Status
 
-Phase 2 complete — Rust + WASM codec shipped (0.1.0). Phase 3: npm publish + voidpay.xyz cutover.
+Phase 2 complete — Rust + WASM codec shipped. Phase 3: npm publish done (0.1.0 live). Remaining: voidpay.xyz cutover (C1 / vl-app #120).
 
 ## Packages
 
 | Package | Status | Description |
 |---------|--------|-------------|
-| `@void-layer/codec` | 0.1.0 ready | Rust + WASM canonical TLV codec |
-| `@void-layer/types` | 0.1.0 ready | Manual TypeScript types (zero runtime deps) |
-| `@void-layer/networks` | 0.1.0 ready | EVM chain configs + token list (no RPC keys) |
+| `@void-layer/codec` | 0.1.0 — live on npm | Rust + WASM canonical TLV codec |
+| `@void-layer/types` | 0.1.0 — live on npm | Manual TypeScript types (zero runtime deps) |
+| `@void-layer/networks` | 0.1.0 — live on npm | EVM chain configs + token list (no RPC keys) |
 
 ## Quick Install
 
@@ -22,8 +22,6 @@ Phase 2 complete — Rust + WASM codec shipped (0.1.0). Phase 3: npm publish + v
 pnpm add @void-layer/codec
 ```
 
-> Not yet published — Phase 3
-
 ## Why
 
 - Third-party developers building on top of VoidPay need a stable, versioned codec they can depend on