diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8fef958..dbc7188 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,33 +5,32 @@ on:
     types: [created]
 
 permissions:
-  id-token: write # Required for OIDC provenance
-  contents: write
+  id-token: write # Required for OIDC provenance attestations
+  contents: write # Required for pushing version bump commit
 
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: pnpm/action-setup0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
-          registry-url: 'https://registry.npmjs.org'
+          registry-url: https://registry.npmjs.org/
+          cache: pnpm
       - run: pnpm install --frozen-lockfile --ignore-scripts
-      - run: pnpm test
-      - run: pnpm run build
-      - name: Bump version
-        run: |
-          VERSION=${GITHUB_REF_NAME#v}
-          pnpm version $VERSION --no-git-tag-version
-      - name: Commit and push version bump
+      - name: Bump version from release tag
         env:
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
+          VERSION=${GITHUB_REF_NAME#v}
+          pnpm version $VERSION --no-git-tag-version
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add package.json pnpm-lock.yaml
-          git commit -m "chore: bump version to ${GITHUB_REF_NAME#v}"
+          git commit -m "chore: bump version to $VERSION"
           git push origin HEAD:$DEFAULT_BRANCH
+      - run: pnpm test
+      - run: pnpm run build
       - run: pnpm publish --no-git-checks