diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a66d792..d592583 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ concurrency: release-${{ github.ref }}
 permissions:
   contents: write # create the version PR / push tags
   pull-requests: write # open and update the version PR
-  id-token: write # npm provenance
+  id-token: write # OIDC token for npm trusted publishing (+ automatic provenance)
 
 jobs:
   release:
@@ -28,6 +28,10 @@ jobs:
           node-version-file: .nvmrc
           cache: pnpm
 
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 22 ships npm 10.x.
+      # `changeset publish` shells out to this global npm to publish each package.
+      - run: npm install -g npm@latest
+
       - run: pnpm install --frozen-lockfile
 
       - name: Create version PR or publish
@@ -43,7 +47,6 @@ jobs:
           commit: 'chore: version packages'
           title: 'chore: version packages'
         env:
+          # No NPM_TOKEN: auth is handled by npm trusted publishing via the OIDC
+          # id-token above, and provenance is generated automatically.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true