diff --git a/.github/workflows/release-package.yaml b/.github/workflows/release-package.yaml
index 35480d9..5477278 100644
--- a/.github/workflows/release-package.yaml
+++ b/.github/workflows/release-package.yaml
@@ -2,12 +2,15 @@ name: Publish package yahtml to npm
 on:
   release:
     types: [published]
-  # Allows you to run this workflow manually from the Actions tab
+  # Keep manual publish from the Actions tab
   workflow_dispatch:
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -16,14 +19,12 @@ jobs:
         with:
           bun-version: 1.2.2
 
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v3
+      # Setup npm registry for trusted publishing via OIDC
+      - uses: actions/setup-node@v4
         with:
           node-version: "20.x"
           registry-url: "https://registry.npmjs.org"
 
       # Publish to npm
       - name: Publish to npm
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
+        run: npm publish --provenance --access public