diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d7cf26c..a5c40bb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,18 +9,8 @@ jobs:
   go:
     runs-on: ubuntu-latest
     steps:
-      # go.mod points at the sibling proto module (the shared claims
-      # contract) with a replace directive until it is published, so both
-      # repos are checked out side by side — same layout as a local clone.
       - uses: actions/checkout@v4
-        with:
-          path: auth
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ github.repository_owner }}/proto
-          path: proto
       - uses: actions/setup-go@v5
         with:
-          go-version-file: auth/go.mod
+          go-version-file: go.mod
       - run: go test ./...
-        working-directory: auth
diff --git a/README.md b/README.md
index d878bff..a86a7d7 100644
--- a/README.md
+++ b/README.md
@@ -40,7 +40,8 @@ sequenceDiagram
 ## Quick start
 
 ```sh
-go build -o priompt-auth .            # Go 1.25+
+go install github.com/priompt/auth/cmd/priompt-auth@latest   # Go 1.25+
+# or, from a clone: go build -o priompt-auth ./cmd/priompt-auth
 
 # 1. one-time: generate the signing keypair
 ./priompt-auth init                   # -> auth.key (kid printed)
@@ -118,7 +119,7 @@ halves. Revoke by deleting the line and restarting.
 ## What an issued token says
 
 Compact EdDSA (Ed25519) JWT. The claims contract is **defined once in the
-shared proto repo (`priomptproto/claims`)** and imported by both this issuer
+shared proto repo (`github.com/priompt/proto/claims`)** and imported by both this issuer
 and the core server's verifier — the two halves cannot drift:
 
 | Claim | Example | Meaning |
@@ -148,14 +149,14 @@ needs no server restart.
 
 | Repo | Role |
 | --- | --- |
-| **priompt** | Imports `priomptauth/authn` for *all* authentication and runs it with `-tokens-file` / `-auth-jwks-url`. Core itself holds no credential code — only authorization (org scoping, the write gate) |
-| **proto** | Hosts the shared claims contract (`priomptproto/claims`) both repos import |
+| **priompt** | Imports `github.com/priompt/auth/authn` for *all* authentication and runs it with `-tokens-file` / `-auth-jwks-url`. Core itself holds no credential code — only authorization (org scoping, the write gate) |
+| **proto** | Hosts the shared claims contract (`github.com/priompt/proto/claims`) both repos import |
 | **python-sdk / js-sdk / cli** | Unchanged — a JWT is just a bearer token to them |
 
 ## `authn` — the importable half
 
 This repo is two things: the `priompt-auth` **binary** at the root, and the
-`priomptauth/authn` **package** it and the core server both import.
+`github.com/priompt/auth/authn` **package** it and the core server both import.
 
 `authn` owns every credential mechanic in the family:
 
diff --git a/authn/jwks.go b/authn/jwks.go
index 68ab1de..a999bc1 100644
--- a/authn/jwks.go
+++ b/authn/jwks.go
@@ -6,7 +6,7 @@ package authn
 // package is the point — they cannot drift, and the round trip is testable.
 //
 // The claims contract itself is defined once in the shared proto repo
-// (priomptproto/claims), so the wire payload is the same struct on both sides.
+// (github.com/priompt/proto/claims), so the wire payload is the same struct on both sides.
 
 import (
 	"crypto/ed25519"
@@ -21,7 +21,7 @@ import (
 	"sync"
 	"time"
 
-	"priomptproto/claims"
+	"github.com/priompt/proto/claims"
 )
 
 // Claims is the payload of a priompt-auth JWT — the shared contract.
diff --git a/main.go b/cmd/priompt-auth/main.go
similarity index 99%
rename from main.go
rename to cmd/priompt-auth/main.go
index 949ab23..774bca3 100644
--- a/main.go
+++ b/cmd/priompt-auth/main.go
@@ -28,7 +28,7 @@ import (
 	"strings"
 	"time"
 
-	"priomptauth/authn"
+	"github.com/priompt/auth/authn"
 )
 
 func main() {
diff --git a/main_test.go b/cmd/priompt-auth/main_test.go
similarity index 99%
rename from main_test.go
rename to cmd/priompt-auth/main_test.go
index b8975bc..68b6015 100644
--- a/main_test.go
+++ b/cmd/priompt-auth/main_test.go
@@ -19,7 +19,7 @@ import (
 	"testing"
 	"time"
 
-	"priomptauth/authn"
+	"github.com/priompt/auth/authn"
 )
 
 // b64 renders a value as a base64url JSON segment, for hand-building the fake
diff --git a/oidc.go b/cmd/priompt-auth/oidc.go
similarity index 100%
rename from oidc.go
rename to cmd/priompt-auth/oidc.go
diff --git a/go.mod b/go.mod
index bd5d8ab..eb3aa04 100644
--- a/go.mod
+++ b/go.mod
@@ -1,18 +1,14 @@
-module priomptauth
+module github.com/priompt/auth
 
 go 1.25.0
 
-require (
-	google.golang.org/grpc v1.82.1
-	priomptproto v0.0.0
-)
+require google.golang.org/grpc v1.82.1
 
 require (
+	github.com/priompt/proto v0.7.0
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )
-
-replace priomptproto => ../proto
diff --git a/go.sum b/go.sum
index 7b006a0..2e20582 100644
--- a/go.sum
+++ b/go.sum
@@ -10,6 +10,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/priompt/proto v0.7.0 h1:93idH7cBiVndmNoznO2vWwKPBw472PLv8MfhCc8SE3w=
+github.com/priompt/proto v0.7.0/go.mod h1:vwz0jk/O+rIf7LYwd20dtLzBtLvnKIbYsL9SFMf6gaY=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=