diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 34440bc..0f33f5f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,7 +50,7 @@ jobs:
         run: npm run build
 
       - name: Publish npm package
-        # NO --provenance: npm rejects provenance attestations from private
-        # source repos (E422 "Unsupported ... visibility: private"). This repo
-        # is private, so provenance was intentionally dropped in 059d114.
-        run: npm publish --access public
+        # --provenance is automatic under trusted publishing, but explicit is
+        # self-documenting. Only valid once the source repo is PUBLIC — npm
+        # rejects provenance from private repos (E422).
+        run: npm publish --access public --provenance
diff --git a/package.json b/package.json
index 002c6ab..d7c6300 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,8 @@
     "url": "https://github.com/fullstorydev/subtext-wizard.git"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "keywords": [
     "subtext",