diff --git a/.github/workflows/npm.yaml b/.github/workflows/npm.yaml
index 30d37bc..acaba81 100644
--- a/.github/workflows/npm.yaml
+++ b/.github/workflows/npm.yaml
@@ -10,6 +10,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
@@ -21,6 +24,9 @@ jobs:
         cache: 'npm'
         registry-url: 'https://registry.npmjs.org/'
 
+    - name: Upgrade npm for Trusted Publishing
+      run: npm install -g npm@latest
+
     - name: Determine pre-release tag
       id: release-tag
       run: |
@@ -43,6 +49,4 @@ jobs:
       run: npm run compile
 
     - name: Publish
-      run: npm publish --access public --tag ${{ env.tag }}
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      run: npm publish --provenance --access public --tag ${{ env.tag }}