diff --git a/.github/workflows/manual_publish_to_npm.yaml b/.github/workflows/manual_publish_to_npm.yaml
index b4a2619..f26f0b9 100644
--- a/.github/workflows/manual_publish_to_npm.yaml
+++ b/.github/workflows/manual_publish_to_npm.yaml
@@ -37,7 +37,9 @@ jobs:
                   cache: 'npm'
                   cache-dependency-path: 'package-lock.json'
             - name: Update npm
-              run: npm install -g npm@latest
+              # Pin to npm 11: npm 12.0.0 ships a broken `libnpmpublish` that requires the
+              # top-level `sigstore` module without bundling it, breaking `npm publish --provenance`.
+              run: npm install -g npm@11
             - name: Install dependencies
               run: npm ci
             - name: Bump pre-release version