diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cd44d8c..952d709 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -41,6 +41,35 @@ jobs:
         run: gh release create "$GITHUB_REF_NAME" --title "Release $GITHUB_REF_NAME" --generate-notes
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  # The BSR remote plugin, so consumers can use `remote: buf.build/roderm/
+  # go-sqlmap` instead of installing the binary. Runs after `release` because
+  # buf.plugin.yaml's license_url points at the tag's LICENSE.
+  plugin:
+    runs-on: ["ubuntu-latest"]
+    needs: release
+    steps:
+      - uses: actions/checkout@v4
+      - uses: bufbuild/buf-setup-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      # buf.plugin.yaml pins the runtime module the generated code imports.
+      # Publishing it out of step with the tag would ship a plugin whose
+      # generated SDKs require a module version that does not exist.
+      - name: Check buf.plugin.yaml is in step with the tag
+        run: |
+          pinned=$(awk '/^plugin_version:/ {print $2}' buf.plugin.yaml)
+          if [ "$pinned" != "$GITHUB_REF_NAME" ]; then
+            echo "::error::buf.plugin.yaml plugin_version is $pinned, tag is $GITHUB_REF_NAME"
+            exit 1
+          fi
+          if ! grep -q "version: $GITHUB_REF_NAME\$" buf.plugin.yaml; then
+            echo "::error::buf.plugin.yaml does not pin the runtime module at $GITHUB_REF_NAME"
+            exit 1
+          fi
+      - name: Push the remote plugin
+        run: buf beta registry plugin push --visibility=public
+        env:
+          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
   builds:
     runs-on: ["ubuntu-latest"]
     needs: release
diff --git a/CLAUDE.md b/CLAUDE.md
index cf3486c..a0de45b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,6 +10,19 @@ The goal is a set of independently switchable plugins over one shared `TableRepo
 
 Plugins are toggled with the `plugins=` protoc parameter, a **`+`-separated** list (protoc already uses `,` between parameters): `--go-sqlmap_out=plugins=schema+scanner:.`. Omitting it enables everything. `plugins` entries live in one slice in `generator.go`; `query` declares `Requires: ["scanner"]` because its output calls the scanner's `Result` type, and enabling it alone is a generation-time error rather than uncompilable Go.
 
+### BSR remote plugin
+
+`buf.plugin.yaml` + `Dockerfile` publish the generator as `buf.build/roderm/go-sqlmap`, so consumers need no local binary:
+
+```yaml
+plugins:
+  - remote: buf.build/roderm/go-sqlmap:v0.1.0
+    out: pkg/generated/
+    opt: [paths=source_relative, plugins=schema+scanner+query]
+```
+
+`buf.plugin.yaml` pins the runtime module the generated code imports (`pkg/query`, `pkg/generated/schema/v1`), so `plugin_version` and `registry.go.deps` must both match the git tag — the release workflow fails if they drift. Publishing happens in CI on tag (`buf beta registry plugin push`, needs `BUF_TOKEN`); it is a separate resource from the `buf.build/roderm/protoc-gen-go-sqlmap` *module* that carries the protos. Test the image locally with `docker build -t x . && protoc --plugin=protoc-gen-y=<script running 'docker run --rm -i x'>`.
+
 **Dependency rule: only `ariga.io/atlas` and `google.golang.org/protobuf` are allowed as direct dependencies.** Ask before adding any other, test-only ones included — prefer plain stdlib loops over utility libraries. Target Go 1.27.
 
 ## Commands
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..cd1f9d8
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,23 @@
+# Image for the BSR remote plugin (buf.build/roderm/go-sqlmap).
+# Built and pushed by `buf beta registry plugin push`, which requires
+# linux/amd64, a minimal base and a non-root user.
+FROM --platform=$BUILDPLATFORM golang:1.27-alpine AS build
+
+WORKDIR /src
+# Copied first so the module cache survives source-only changes.
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY cmd/ cmd/
+COPY pkg/ pkg/
+
+# Static, stripped, and reproducible: the plugin runs in a scratch image with
+# no libc and no build metadata worth carrying.
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" \
+    -o /out/protoc-gen-go-sqlmap ./cmd/protoc-gen-go-sqlmap
+
+FROM scratch
+COPY --from=build /out/protoc-gen-go-sqlmap /protoc-gen-go-sqlmap
+USER 65532:65532
+ENTRYPOINT ["/protoc-gen-go-sqlmap"]
diff --git a/buf.plugin.yaml b/buf.plugin.yaml
new file mode 100644
index 0000000..5324b7f
--- /dev/null
+++ b/buf.plugin.yaml
@@ -0,0 +1,28 @@
+version: v1
+name: buf.build/roderm/go-sqlmap
+# Keep in step with the git tag: registry.go.deps below pins the runtime
+# packages the generated code imports, and they ship from this repo.
+plugin_version: v0.1.0
+
+description: Generates SQL schema definitions, row scanners and FieldMask-aware queries with eager loading from sqlmap-annotated messages.
+source_url: https://github.com/roderm/protoc-gen-go-sqlmap
+spdx_license_id: MIT
+license_url: https://github.com/roderm/protoc-gen-go-sqlmap/blob/v0.1.0/LICENSE
+output_languages:
+  - go
+
+# The generated .sqlmap.go extends the message types protoc-gen-go emits, so it
+# is only compilable alongside them.
+deps:
+  - plugin: buf.build/protocolbuffers/go:v1.36.11
+
+registry:
+  go:
+    min_version: "1.27"
+    deps:
+      # pkg/generated/schema/v1 (SchemaTable/SchemaColumn) and pkg/query
+      # (Mask, Conn) are imported by the generated code.
+      - module: github.com/roderm/protoc-gen-go-sqlmap
+        version: v0.1.0
+      - module: google.golang.org/protobuf
+        version: v1.36.11