diff --git a/CHANGELOG.md b/CHANGELOG.md
index 816d7a5..501e626 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,9 @@ All notable changes to this project are documented here. The format is based on
   `PUBLISH_REGISTRY` variable on a tag push (npm when unset), and reports a version a registry already
   has instead of failing. `.dev/tools/npm-release github|npm` publishes every missing release; see
   `docs/release.md`.
+- **The install docs say where Tabar is published.** 0.5.0 and 0.6.0 are on GitHub Packages,
+  which needs a scoped `.npmrc` and a `read:packages` token; the README and
+  `docs/installation.md` show both, and note that the CDN links resolve only once Tabar is on npm.
 - **Configurable border** — `borderWidth`/`borderStyle`/`borderColor` (and `setBorder`) outline
   the linear track; `--tabar-border-*` CSS vars; settable via `<tabar-bar>`/`data-tabar-*`.
 - **Broader, consistent API.** New chainable setters — `setSize`, `setShape`
diff --git a/README.md b/README.md
index 395e0fe..a75f3e5 100644
--- a/README.md
+++ b/README.md
@@ -51,6 +51,19 @@ bar.done();                 // glide to 100%, then hide
 npm install @simtabi/tabar
 ```
 
+`@simtabi/tabar` is published to GitHub Packages, not npm, for now. GitHub Packages asks for a
+token even for a public package, so before `npm install` add a GitHub token with `read:packages` to
+the project's `.npmrc`:
+
+```ini
+@simtabi:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}
+```
+
+> The CDN links below serve from npm (jsDelivr and unpkg read the npm registry), and Tabar is on
+> GitHub Packages only for now, so they resolve once it is published to npm. Until then, install it
+> as above and bundle it, or serve `dist/` from your own build.
+
 Or drop in the ready-to-use script from a CDN — exposes a global `Tabar`, no build step:
 
 ```html
diff --git a/docs/installation.md b/docs/installation.md
index e30eb74..a03e880 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -9,6 +9,15 @@ plain `<script>` use.
 npm install @simtabi/tabar
 ```
 
+`@simtabi/tabar` is published to GitHub Packages, not npm, for now. GitHub Packages asks for a
+token even for a public package, so before `npm install` add a GitHub token with `read:packages` to
+the project's `.npmrc`:
+
+```ini
+@simtabi:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}
+```
+
 ```js
 import { Tabar } from '@simtabi/tabar';
 
@@ -55,6 +64,10 @@ See [Multi-progress, CLI & feedback](tools/multi-and-cli.md) for the full termin
 
 ## CDN / drop-in `<script>`
 
+> The CDN links below serve from npm (jsDelivr and unpkg read the npm registry), and Tabar is on
+> GitHub Packages only for now, so they resolve once it is published to npm. Until then, install it
+> as above and bundle it, or serve `dist/` from your own build.
+
 The minified IIFE build is a single, ready-to-use file that exposes a global `Tabar` — no
 build step, no bundler:
 
diff --git a/docs/release.md b/docs/release.md
index 641579f..1c25596 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -1,8 +1,9 @@
 # Release
 
-Tabar is published to npm as [`@simtabi/tabar`](https://www.npmjs.com/package/@simtabi/tabar).
-Releases are tag-driven and use npm OIDC **trusted publishing** with provenance — no
-long-lived tokens.
+Tabar's releases are tag-driven. They publish `@simtabi/tabar` to the registry the repository
+variable `PUBLISH_REGISTRY` names, which is `github` (GitHub Packages) today: 0.5.0 and 0.6.0 are
+there, and nothing is on npm yet. The npm route uses OIDC **trusted publishing** with provenance
+once the npm trusted publisher is configured (see *First-release setup* below).
 
 ## Versioning
 
@@ -15,6 +16,10 @@ Semantic Versioning. There is a single source of version truth: `package.json::v
 2. Bump the version: `npm version X.Y.Z` (creates the commit and `vX.Y.Z` tag).
 3. Push: `git push && git push --tags`.
 
+A tag push runs `release.yml` **as it is at the tagged commit**. A tag cut before the
+`registry` input existed (0.5.0 and 0.6.0) therefore only knows npm; publish such a tag with
+`.dev/tools/npm-release github`, which starts the workflow as it is on `main`.
+
 Pushing the tag triggers `.github/workflows/release.yml`, which:
 
 - runs lint, tests and the build,