diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2bc272a..5702996 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -122,6 +122,13 @@ jobs:
           npm test
 
       # ---- npm ----
+      # npm trusted publishing (OIDC): with this package's Trusted Publisher set
+      # to this repo + publish.yml on npmjs.com, npm >= 11.5.1 exchanges the
+      # job's id-token for a one-off publish credential, so no long-lived
+      # NPM_TOKEN is needed. The token stays below as a fallback until every
+      # package is switched over.
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@^11.5.1
       - name: Publish to npm
         id: npm
         if: steps.v.outputs.pkg != steps.v.outputs.npm