diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d535470f..c0d7e557 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,9 +22,10 @@ jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write # Required for npm OIDC trusted publishing
     env:
-      NODE_AUTH_TOKEN: ${{secrets.NPM_AUTH_TOKEN}}
-      NPM_TOKEN: ${{secrets.NPM_AUTH_TOKEN}}
       GH_TOKEN: ${{secrets.PUBLISH_TOKEN}}
     steps:
       - uses: actions/checkout@v4
@@ -41,6 +42,8 @@ jobs:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
           cache: npm
+      # Trusted publishing requires npm >= 11.5.1; Node 22 ships npm 10.x
+      - run: npm install -g npm@latest
       - run: git config --global user.email "167322027+revideo-bot@users.noreply.github.com"
       - run: git config --global user.name "revideo-bot"
       - run: npm ci