diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c739b28..4411935 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,12 +30,17 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: smoketest
     runs-on: ubuntu-latest
+    permissions:
+      contents: write   # create the GitHub release
+      id-token: write   # OIDC for npm trusted publishing
     steps:
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest
       - run: npm ci
       - run: npm run build
 
@@ -49,6 +54,4 @@ jobs:
           files: "*.tgz"
 
       - name: Publish to npm
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public --provenance
diff --git a/package-lock.json b/package-lock.json
index 9118db1..62043ff 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@bobbin/cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bobbin/cli",
-      "version": "0.1.4",
+      "version": "0.1.5",
       "dependencies": {
         "commander": "^12.1.0"
       },
diff --git a/package.json b/package.json
index b61cee0..2096e46 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bobbin/cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Agent-first terminal recording",
   "type": "module",
   "bin": {
diff --git a/src/cli.ts b/src/cli.ts
index f15acf6..7ec090e 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -19,7 +19,7 @@ process.on("unhandledRejection", (err) => {
 program
   .name("bobbin")
   .description("Agent-first terminal recording")
-  .version("0.1.4", "-v, --version")
+  .version("0.1.5", "-v, --version")
 
 program
   .command("rec")