diff --git a/.changeset/filter-system-identity.md b/.changeset/filter-system-identity.md
deleted file mode 100644
index 1b8283a..0000000
--- a/.changeset/filter-system-identity.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"opencode-workspace-env": patch
----
-
-Filter system identity variables (HOME, USER, LOGNAME, SHELL, HOSTNAME) from env injection to prevent overriding host values
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 74a83fe..9881cee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
@@ -20,8 +21,8 @@ jobs:
       - name: Create release PR or publish
         uses: changesets/action@v1
         with:
-          version: bunx changeset version
-          publish: npm publish
+          version: bunx changeset version && node scripts/sync-version.mjs
+          publish: npm publish --provenance --access public
           title: "chore: release"
           commit: "chore: release"
         env:
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..ae64359
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..235408d
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,7 @@
+# opencode-workspace-env
+
+## 0.1.1
+
+### Patch Changes
+
+- [#1](https://github.com/yimsk/opencode-workspace-env/pull/1) [`b8a8b5b`](https://github.com/yimsk/opencode-workspace-env/commit/b8a8b5b0c45ee7c3477cdab70f1fb5c285b532b5) Thanks [@yimsk](https://github.com/yimsk)! - Filter system identity variables (HOME, USER, LOGNAME, SHELL, HOSTNAME) from env injection to prevent overriding host values
diff --git a/package.json b/package.json
index 70cb337..3899f91 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "opencode-workspace-env",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "OpenCode plugin for per-workspace env injection via shell.env hook",
   "type": "module",
   "main": "dist/index.js",
diff --git a/scripts/sync-version.mjs b/scripts/sync-version.mjs
new file mode 100644
index 0000000..5d997be
--- /dev/null
+++ b/scripts/sync-version.mjs
@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// Sync src/index.ts version with package.json after changeset version
+import { readFileSync, writeFileSync } from "node:fs";
+
+const pkg = JSON.parse(readFileSync("package.json", "utf8"));
+const indexPath = "src/index.ts";
+const content = readFileSync(indexPath, "utf8");
+const updated = content.replace(
+  /export const version = "[^"]+"/,
+  `export const version = "${pkg.version}"`
+);
+if (content !== updated) {
+  writeFileSync(indexPath, updated);
+  console.log(`synced src/index.ts version to ${pkg.version}`);
+}
diff --git a/src/index.ts b/src/index.ts
index 91800f4..cb85446 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -6,7 +6,7 @@ import { resolveEnvSource } from "./resolve.js";
 import type { EnvExportResult } from "./types.js";
 
 export const name = "opencode-workspace-env";
-export const version = "0.1.0";
+export const version = "0.1.1";
 export const description = "OpenCode plugin for per-workspace env injection via shell.env hook";
 
 const cache = new EnvCache();
diff --git a/tests/index.test.ts b/tests/index.test.ts
index 9d33b90..ebb66bd 100644
--- a/tests/index.test.ts
+++ b/tests/index.test.ts
@@ -1,10 +1,11 @@
 import { describe, expect, it } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import type { Hooks, PluginInput } from "@opencode-ai/plugin";
 
 const repoRoot = join(import.meta.dir, "..");
+const pkg = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf-8"));
 const scratchRoot = join(repoRoot, ".sisyphus");
 mkdirSync(scratchRoot, { recursive: true });
 const defaultModulePath = join(repoRoot, "dist/index.js");
@@ -38,9 +39,9 @@ function createCompliantPluginFixture(): { cleanup: () => void; modulePath: stri
   writeFileSync(
     modulePath,
     [
-      'export const name = "opencode-workspace-env";',
-      'export const version = "0.1.0";',
-      'export const description = "OpenCode plugin for per-workspace env injection via shell.env hook";',
+      `export const name = "${pkg.name}";`,
+      `export const version = "${pkg.version}";`,
+      `export const description = "${pkg.description}";`,
       "",
       "export default async function plugin(_input) {",
       "  return {",
@@ -54,9 +55,9 @@ function createCompliantPluginFixture(): { cleanup: () => void; modulePath: stri
     typesPath,
     [
       'import type { Hooks, PluginInput } from "@opencode-ai/plugin";',
-      'export declare const name = "opencode-workspace-env";',
-      'export declare const version = "0.1.0";',
-      'export declare const description = "OpenCode plugin for per-workspace env injection via shell.env hook";',
+      `export declare const name = "${pkg.name}";`,
+      `export declare const version = "${pkg.version}";`,
+      `export declare const description = "${pkg.description}";`,
       "export default function plugin(_input: PluginInput): Promise<Hooks>;",
     ].join("\n")
   );
@@ -145,11 +146,9 @@ describe("opencode-workspace-env entrypoint contract", () => {
     await withResolvedPluginTarget(async ({ modulePath }) => {
       const mod = await loadPluginModule(modulePath);
 
-      expect(mod.name).toBe("opencode-workspace-env");
-      expect(mod.version).toBe("0.1.0");
-      expect(mod.description).toBe(
-        "OpenCode plugin for per-workspace env injection via shell.env hook"
-      );
+      expect(mod.name).toBe(pkg.name);
+      expect(mod.version).toBe(pkg.version);
+      expect(mod.description).toBe(pkg.description);
     });
   });