diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9a6a1be..e030b11 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,4 +28,5 @@ jobs:
           GITHUB_TOKEN: ${{secrets.RELEASER_TOKEN}}
 
       - run: pnpm i
-      - run: pnpm publish --no-git-checks --access public --filter objecs
+      # OIDC trusted publishing — no token needed
+      - run: pnpm publish --no-git-checks --access public --provenance --filter objecs