diff --git a/CHANGELOG.md b/CHANGELOG.md
index 88ff053..0b85fd2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 # Unreleased
 
 
+# 0.2.1 (2026-06-23)
+
+## Bug fixes
+- `package.json`: Add missing `repository.url` to meet NPM's provenance
+  requirements.
+
+
 # 0.2.0 (2026-06-22)
 
 ## Features
diff --git a/package-lock.json b/package-lock.json
index ff7feb8..44a2c0c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "tuor-sandbox",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tuor-sandbox",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/gondolin": "^0.12.0",
diff --git a/package.json b/package.json
index cd672e4..df1f25b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,10 @@
 {
   "name": "tuor-sandbox",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": "codethief <git@codethief.eu>",
+  "repository": {
+    "url": "github:codethief/tuor"
+  },
   "license": "Apache-2.0",
   "type": "module",
   "files": [