diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7bc116b..5a00966 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,6 +26,10 @@ jobs:
           node-version: 22
           cache: npm
 
+      # Trusted publishing (OIDC) requires npm >= 11.5.1; Node 22 still ships npm 10.
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
@@ -35,8 +39,9 @@ jobs:
       - name: Test
         run: npm test
 
+      # No NPM_TOKEN: @semantic-release/npm authenticates to npm via OIDC
+      # trusted publishing (needs id-token: write, granted above).
       - name: Release
         run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}