diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4ea512e5..a1df7461 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,31 +3,29 @@ name: Publish to PyPI
 on:
   push:
     tags:
-      - "v*"
+      - "v*.*.*"
 
 permissions:
   contents: read
-  id-token: write
+  id-token: write  # for OIDC trusted publishing
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v6
+      - uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
-      - name: Install hatchling
-        run: pip install hatchling
+      - name: Install build
+        run: pip install build
 
-      - name: Build package
-        run: python -m hatchling build
+      - name: Build distributions
+        run: python -m build
 
-      - name: Upload dist artifact
-        uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v4
         with:
           name: dist
           path: dist/
@@ -36,12 +34,12 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     environment: pypi
+    permissions:
+      id-token: write
     steps:
-      - name: Download dist artifact
-        uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@v4
         with:
           name: dist
           path: dist/
 
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
new file mode 100644
index 00000000..d975196e
--- /dev/null
+++ b/.github/workflows/release-drafter.yml
@@ -0,0 +1,25 @@
+name: Release Drafter
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  draft-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --title "cmcp ${{ github.ref_name }}" \
+            --generate-notes \
+            --draft
diff --git a/pyproject.toml b/pyproject.toml
index 107bb164..791915d7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,6 +8,10 @@ version = "0.1.0"
 description = "Hardware-attested MCP gateway — TEE-enforced policy and TRACE Claim generation"
 readme = "README.md"
 license = { text = "MIT" }
+authors = [
+    { name = "AgentTrust Contributors", email = "oss@agentrust.io" },
+]
+keywords = ["mcp", "tee", "attestation", "security", "ai-agents", "cedar"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",
@@ -48,6 +52,12 @@ dev = [
 [project.scripts]
 cmcp = "cmcp_gateway.cli:main"
 
+[project.urls]
+Homepage = "https://github.com/agentrust-io/cmcp"
+Repository = "https://github.com/agentrust-io/cmcp"
+Documentation = "https://github.com/agentrust-io/cmcp#readme"
+"Bug Tracker" = "https://github.com/agentrust-io/cmcp/issues"
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/cmcp_gateway", "src/cmcp_verify"]