diff --git a/CHANGELOG.md b/CHANGELOG.md
index 749aa7f..b128947 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- `package.json` `files` allowlist - publishes only `lib/` and `CHANGELOG.md` alongside the npm-default `README.md`, `LICENSE`, and `package.json`. Trims `.github/`, `.tartufo/`, `tartufo.toml`, `.jshintrc`, `.nvmrc`, `.npmrc`, `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md`, and `SECURITY.md` from the published tarball.
+- `README.md` - License section pointing to `LICENSE`.
+
+### Changed
+- `package.json` `repository.url` - SSH (`git@github.com:...`) -> HTTPS (`https://github.com/...`); npm convention and avoids `npm publish` warnings.
 
 ## [0.0.49] - 2026-03-03
 ### Added
diff --git a/README.md b/README.md
index 11a4c8b..93deb78 100644
--- a/README.md
+++ b/README.md
@@ -290,3 +290,7 @@ poynt.charge(
 - `unregisterApplePayMerchant`
 - `getApplePayMerchant`
 - `getApplePayDomainAssociationFile`
+
+## License
+
+MIT - see [LICENSE](./LICENSE).
diff --git a/package.json b/package.json
index 4a151e4..acbd951 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,10 @@
   "version": "0.0.49",
   "description": "Poynt Node.js SDK",
   "main": "lib/index.js",
+  "files": [
+    "lib",
+    "CHANGELOG.md"
+  ],
   "engines": {
     "node": ">=14.0.0"
   },
@@ -21,7 +25,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git@github.com:godaddy/poynt-node.git"
+    "url": "https://github.com/godaddy/poynt-node.git"
   },
   "keywords": [
     "Poynt",