diff --git a/CHANGELOG.md b/CHANGELOG.md
index c258c3c..b4fd7b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-- ...
+- `script/release` accepts `--otp CODE` and forwards it to `gem push` via `GEM_HOST_OTP_CODE`, so a TOTP code can stand in for the WebAuthn browser handoff.
 
 ## [0.4.0] - 2026-09-24
 
diff --git a/script/release b/script/release
index d6895c4..19ec592 100755
--- a/script/release
+++ b/script/release
@@ -1,8 +1,30 @@
 #!/bin/sh
 # Tag and push a release to RubyGems and npm
+#
+# Usage: script/release [--otp CODE]
+#
+# --otp CODE  Six-digit code from your RubyGems TOTP authenticator. Passing it
+#             skips the WebAuthn browser handoff that `gem push` otherwise
+#             requires when MFA is enabled on the account.
 
 set -e
 
+case "$1" in
+  --otp)
+    [ -n "$2" ] || { echo "Usage: script/release [--otp CODE]"; exit 1; }
+    export GEM_HOST_OTP_CODE="$2"
+    ;;
+  --otp=*)
+    export GEM_HOST_OTP_CODE="${1#--otp=}"
+    ;;
+  "")
+    ;;
+  *)
+    echo "Usage: script/release [--otp CODE]"
+    exit 1
+    ;;
+esac
+
 # Fail fast before the gem publish if npm credentials are missing.
 npm whoami > /dev/null 2>&1 || { echo "Not logged in to npm. Run 'npm login' first."; exit 1; }