diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..a6a8b4e
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,69 @@
+name: Publish
+on:
+  release:
+    types: [published]
+jobs:
+  publish:
+    name: Publish npm package on release
+    runs-on: ubuntu-latest
+    # Guard rails: only publish from canonical repo, never from forks
+    if: >-
+      github.event.repository.fork == false &&
+      github.repository_owner == 'ImagingDataCommons'
+    permissions:
+      contents: read
+      id-token: write
+    concurrency:
+      group: npm-publish-${{ github.ref }}
+      cancel-in-progress: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - name: Install emscripten
+        uses: mymindstorm/setup-emsdk@v14
+        with:
+          version: 4.0.19
+          actions-cache-folder: ".emsdk-cache"
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.16.0"
+          registry-url: "https://registry.npmjs.org"
+      - name: Install yarn package manager
+        run: npm install --global yarn
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y liblcms2-dev autoconf cmake
+      - name: Build and install library
+        run: |
+          mkdir build
+          cd build
+          cmake ..
+          make
+          sudo make install
+      - name: Build WebAssembly bindings
+        run: |
+          yarn run clean
+          yarn run build
+      - name: Verify package version matches tag
+        run: |
+          set -euo pipefail
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          TAG="${{ github.event.release.tag_name }}"
+          if [ -z "$TAG" ]; then TAG="${GITHUB_REF#refs/tags/}"; fi
+          if [ -z "$TAG" ]; then
+            echo "Error: could not determine release tag from github.event.release.tag_name or GITHUB_REF"
+            exit 1
+          fi
+          TAG="${TAG#v}"
+          if [ "$PKG_VERSION" != "$TAG" ]; then
+            echo "Version mismatch: package.json=$PKG_VERSION tag=$TAG"
+            exit 1
+          fi
+          echo "Version OK: $PKG_VERSION"
+      - name: Publish to npm
+        run: |
+          npm publish . --provenance --access public
diff --git a/.github/workflows/run_unit_tests.yml b/.github/workflows/run_unit_tests.yml
index 28ae782..e317be7 100644
--- a/.github/workflows/run_unit_tests.yml
+++ b/.github/workflows/run_unit_tests.yml
@@ -1,11 +1,9 @@
 name: build and test
-
 on:
   push:
-    branches: [ master ]
+    branches: [master]
   pull_request:
-    branches: [ master ]
-
+    branches: [master]
 jobs:
   linux:
     name: Build and run tests on Linux
@@ -15,96 +13,83 @@ jobs:
       matrix:
         os: [ubuntu-latest]
     steps:
-    - uses: actions/checkout@v2
-    - name: Install build and test dependencies
-      run: |
-        export DEBIAN_FRONTEND=noninteractive
-        export DEBCONF_NONINTERACTIVE_SEEN=true
-        sudo apt-get update
-        sudo apt-get install -y --no-install-suggests --no-install-recommends \
-          autogen \
-          dh-autoreconf \
-          build-essential \
-          clang \
-          cmake \
-          git \
-          liblcms2-dev \
-          llvm \
-          libtool \
-          nodejs \
-          npm \
-          pkg-config \
-          python3 \
-          shtool \
-          valgrind
-        sudo apt-get clean
-
-    - name: Install yarn package manager
-      run: npm install --global yarn
-
-    - name: Build and install library
-      run: |
-        mkdir build
-        cd build
-        cmake ..
-        make
-        sudo make install
-
-    - name: Build and install Emscripten SDK
-      run: |
-        git clone https://github.com/emscripten-core/emsdk.git
-        cd emsdk
-        git pull
-        ./emsdk install latest
-        ./emsdk activate latest
-        source ./emsdk_env.sh
-
-    - name: Build WebAssembly bindings
-      run: |
-        yarn run clean
-        sh ./emsdk/emsdk activate latest
-        source ./emsdk/emsdk_env.sh
-        yarn run build
-
-    - name: Perform npm package publish dry run
-      run: |
-        sh ./emsdk/emsdk activate latest
-        source ./emsdk/emsdk_env.sh
-        npm publish . --dry-run
-
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - name: Install emscripten
+        uses: mymindstorm/setup-emsdk@v14
+        with:
+          version: 4.0.19
+          actions-cache-folder: ".emsdk-cache"
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.16.0"
+      - name: Install yarn package manager
+        run: npm install --global yarn
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y liblcms2-dev autoconf cmake
+      - name: Build and install library
+        run: |
+          mkdir build
+          cd build
+          cmake ..
+          make
+          sudo make install
+      - name: Build WebAssembly bindings
+        run: |
+          yarn run clean
+          yarn run build
+      - name: Perform npm package publish dry run
+        run: |
+          npm publish . --dry-run
   macos:
     name: Build and run tests on macOS
-    runs-on: macos-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
+      matrix:
+        os: [macos-latest]
     steps:
-    - uses: actions/checkout@v2
-    - name: Install build and test dependencies
-      run: |
-        brew update
-        brew upgrade
-        brew install \
-          autoconf \
-          automake \
-          emscripten \
-          libtool \
-          little-cms2 \
-          llvm \
-          node \
-          yarn
-
-    - name: Build and install library
-      run: |
-        mkdir build
-        cd build
-        cmake -DCMAKE_PREFIX_PATH=$PWD/install -DCMAKE_INSTALL_PREFIX=$PWD/install  ..
-        make
-        make install
-
-    - name: Build WebAssembly bindings
-      run: |
-        yarn run clean
-        yarn run build
-
-    - name: Perform npm package publish dry run
-      run: npm publish . --dry-run
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - name: Install emscripten
+        uses: mymindstorm/setup-emsdk@v14
+        with:
+          version: 4.0.19
+          actions-cache-folder: ".emsdk-cache"
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.16.0"
+      - name: Install yarn package manager
+        run: npm install --global yarn
+      - name: Install dependencies
+        run: |
+          brew update
+          brew upgrade
+          brew install \
+            autoconf \
+            automake \
+            libtool \
+            little-cms2 \
+            llvm \
+            cmake
+      - name: Build and install library
+        run: |
+          mkdir build
+          cd build
+          cmake -DCMAKE_PREFIX_PATH=$PWD/install -DCMAKE_INSTALL_PREFIX=$PWD/install  ..
+          make
+          make install
+      - name: Build WebAssembly bindings
+        run: |
+          yarn run clean
+          yarn run build
+      - name: Perform npm package publish dry run
+        run: npm publish . --dry-run
\ No newline at end of file
diff --git a/BUILDING.md b/BUILDING.md
index 4abd245..ed52e5f 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -44,7 +44,7 @@ The examples expects the lcms2, dicom, and dicomicc libraries to be already inst
 The build dependencies used for building the WASM binding are as follows:
 
 * CMake 3.16
-* Emscripten SDK 1.39.4
+* Emscripten SDK 4.0.19
 
 Earlier versions may work but have not been tested.
 
diff --git a/package.json b/package.json
index cb3f651..4fcf7c9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@imagingdatacommons/dicomicc",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "WASM bindings and JavaScript API for the dicomicc C library",
   "main": "dist/dicomiccwasm.js",
   "publishConfig": {