diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aedca9c..0608cde 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,15 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: write
+  pull-requests: write
+  # npm trusted publishing (OIDC): the release job mints a short-lived npm
+  # credential from the workflow's identity, so no NPM_TOKEN secret is needed.
+  # The trusted publisher registered on npmjs.com must name this repo and this
+  # workflow file (release.yml) or the publish fails with E403/E404.
+  id-token: write
+
 jobs:
   release:
     name: Release
@@ -20,10 +29,12 @@ jobs:
           # https://github.com/pnpm/pnpm/issues/8953
           version: 9.15.3
 
-      - name: Use Node.js from nvmrc
+      # Node 24 (npm >= 11.5.1) for the publish: OIDC trusted publishing
+      # needs a newer npm than the .nvmrc toolchain (Node 22 / npm 10) ships.
+      - name: Setup Node.js 24.x
         uses: actions/setup-node@v4
         with:
-          node-version-file: '.nvmrc'
+          node-version: 24.x
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
@@ -36,4 +47,6 @@ jobs:
           publish: pnpm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
\ No newline at end of file
+          # Provenance attestation for the published tarball; requires the
+          # OIDC id-token permission above.
+          NPM_CONFIG_PROVENANCE: 'true'