diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 786603b..9ee3124 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,7 +2,7 @@ name: Release
 
 # Fires on git tags shaped like v1.0.0, v1.0.1, v1.1.0, etc.
 # - Builds + verifies (tests).
-# - Publishes to npm with --provenance (uses NPM_TOKEN secret).
+# - Publishes to npm with --provenance via npm Trusted Publishing (OIDC).
 # - Creates a GitHub Release with auto-generated notes.
 
 on:
@@ -62,10 +62,14 @@ jobs:
           fi
           echo "CLI version smoke: $BUILT_VERSION"
 
+      # OIDC trusted publishing requires npm >= 11.5.1; Node 20 bundles
+      # npm 10.x, so upgrade the global npm before the publish call.
+      - name: Upgrade npm for OIDC trusted publishing (>= 11.5.1)
+        run: npm install -g npm@latest
+
       - name: Publish to npm (with provenance)
+        # Auth via npm Trusted Publishing (OIDC) - intentionally NO NODE_AUTH_TOKEN.
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub Release
         env: