diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b7162676..70249eff 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,6 +12,7 @@ concurrency:
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 jobs:
   publish:
@@ -24,28 +25,53 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: 22.x
           cache: pnpm
 
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@11.5.1
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Create Release Pull Request or Publish
+      - name: Create Release Pull Request
+        if: github.ref == 'refs/heads/master'
         id: changesets
         uses: changesets/action@v1
         with:
-          publish: ${{ github.ref == 'refs/heads/master' && 'pnpm run release' || 'pnpm --filter upup-react-file-uploader run test-release' }}
           createGithubReleases: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Check if current package version still needs publishing
+        if: github.ref == 'refs/heads/master' && steps.changesets.outputs.hasChangesets == 'false'
+        id: package_meta
+        shell: bash
+        run: |
+          NAME=$(node -p "require('./packages/upup/package.json').name")
+          VERSION=$(node -p "require('./packages/upup/package.json').version")
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
+            echo "needs_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "needs_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish to npm
+        if: github.ref == 'refs/heads/master' && steps.changesets.outputs.hasChangesets == 'false' && steps.package_meta.outputs.needs_publish == 'true'
+        run: pnpm run release
+
+      - name: Dry-run release on dev
+        if: github.ref == 'refs/heads/dev'
+        run: pnpm --filter upup-react-file-uploader run test-release
 
       - name: Create GitHub Release
-        if: steps.changesets.outputs.published == 'true' && github.ref == 'refs/heads/master'
+        if: github.ref == 'refs/heads/master' && steps.changesets.outputs.hasChangesets == 'false' && steps.package_meta.outputs.needs_publish == 'true'
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ fromJson(steps.changesets.outputs.publishedPackages)[0].name }}@${{ fromJson(steps.changesets.outputs.publishedPackages)[0].version }}
-          name: ${{ fromJson(steps.changesets.outputs.publishedPackages)[0].name }}@${{ fromJson(steps.changesets.outputs.publishedPackages)[0].version }}
+          tag_name: ${{ steps.package_meta.outputs.name }}@${{ steps.package_meta.outputs.version }}
+          name: ${{ steps.package_meta.outputs.name }}@${{ steps.package_meta.outputs.version }}
           generate_release_notes: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}