diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 35a18dc..fe9d8d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -234,6 +234,12 @@ jobs:
               echo "$name@$version is already on npm; skipping."
               continue
             fi
+            # npm provenance requires repository.url to match this repository.
+            # Set it on the runner copy so tags made before the field existed
+            # can still be published.
+            (cd "$dir" && npm pkg set repository.type=git \
+              "repository.url=https://github.com/${GITHUB_REPOSITORY}" \
+              "repository.directory=$dir")
             # pnpm pack rewrites workspace:* to the real version.
             tarball=$(cd "$dir" && pnpm pack --pack-destination "$RUNNER_TEMP/packages" | tail -1)
             if tar -xOzf "$tarball" package/package.json | grep -q '"workspace:'; then
diff --git a/studio/packages/editor-core/package.json b/studio/packages/editor-core/package.json
index 308b429..5242bea 100644
--- a/studio/packages/editor-core/package.json
+++ b/studio/packages/editor-core/package.json
@@ -54,5 +54,10 @@
     "tsup": "^8.5.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.11"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rendis/statepro",
+    "directory": "studio/packages/editor-core"
   }
 }
diff --git a/studio/packages/web-component/package.json b/studio/packages/web-component/package.json
index 2ba4592..85971ed 100644
--- a/studio/packages/web-component/package.json
+++ b/studio/packages/web-component/package.json
@@ -37,5 +37,10 @@
     "typescript": "^5.7.3",
     "vitest": "^4.1.11",
     "jsdom": "^26.0.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rendis/statepro",
+    "directory": "studio/packages/web-component"
   }
 }