diff --git a/.ngit/act/workflows/rust_ci.yaml b/.ngit/act/workflows/rust_ci.yaml
index dc9710c..78f0328 100644
--- a/.ngit/act/workflows/rust_ci.yaml
+++ b/.ngit/act/workflows/rust_ci.yaml
@@ -66,3 +66,16 @@ jobs:
       - run: nix develop --command cargo clippy --workspace --all-targets -- -D warnings
       - run: nix develop --command cargo test --locked
       - run: nix develop --command cargo test -p grasp-audit --locked
+      - name: Publish release tag to crates.io
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          version="$(nix eval --impure --raw --expr '(builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.version')"
+          if [[ "$GITHUB_REF" != "refs/tags/v$version" ]]; then
+            echo "release tag must match Cargo.toml version v$version" >&2
+            exit 1
+          fi
+          : "${CARGO_REGISTRY_TOKEN:?Configure the repository CARGO_REGISTRY_TOKEN secret in ngit-ci}"
+          nix develop --command cargo publish --locked --registry crates-io --package ngit-grasp
diff --git a/docs/how-to/publish-crate.md b/docs/how-to/publish-crate.md
new file mode 100644
index 0000000..ca526a5
--- /dev/null
+++ b/docs/how-to/publish-crate.md
@@ -0,0 +1,21 @@
+# Publish ngit-grasp to crates.io
+
+Nostr CI publishes `ngit-grasp` after the existing formatting, lint and test
+steps pass for a `v*` tag push. The tag must exactly match `v` followed by the
+package version in `Cargo.toml`, including any prerelease suffix. Branch pushes
+and pull requests do not publish crates. The unpublished `grasp-audit` workspace
+member is not selected for publication.
+
+Configure the repository's `CARGO_REGISTRY_TOKEN` secret in ngit-ci with a
+crates.io token scoped to publishing `ngit-grasp`. The token is supplied only
+to the publication step; Cargo does not write a login credential file.
+
+The workflow runs `cargo publish --locked --registry crates-io --package
+ngit-grasp`, including Cargo's package verification. A missing token or an
+already-published version fails the step; the workflow does not overwrite or
+automatically bump releases.
+
+The workflow must be included in the tagged commit. Adding it does not
+backfill existing tags, and crate publication is independent of the existing
+archive, NIP-82 and container publication jobs. It requires no GitHub registry
+authentication.