diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d5a558d5..c0c6bc1b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -51,6 +51,13 @@ jobs:
           npm run typecheck
           npm test
 
+      # npm trusted publishing (OIDC): with this package's Trusted Publisher set
+      # to this repo + publish.yml on npmjs.com, npm >= 11.5.1 exchanges the
+      # job's id-token for a one-off publish credential, so no long-lived
+      # NPM_TOKEN is needed. The token stays below as a fallback until every
+      # package is switched over.
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@^11.5.1
       - name: Publish to npm
         if: steps.v.outputs.pkg != steps.v.outputs.npm
         run: npm publish --provenance --access public