diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5e10e35..0088316 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release:
@@ -25,6 +26,10 @@ jobs:
           cache: 'npm'
           registry-url: 'https://registry.npmjs.org'
 
+      # Trusted publishing (OIDC) requires npm >= 11.5.1; runners ship npm 10.x
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
@@ -37,5 +42,4 @@ jobs:
       - name: Semantic Release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release
diff --git a/.releaserc.json b/.releaserc.json
index e64b95b..468f1b0 100644
--- a/.releaserc.json
+++ b/.releaserc.json
@@ -9,7 +9,7 @@
         "changelogFile": "CHANGELOG.md"
       }
     ],
-    ["@semantic-release/npm", { "npmPublish": false }],
+    "@semantic-release/npm",
     [
       "@semantic-release/git",
       {
diff --git a/README.md b/README.md
index e65a30f..10f9bde 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,14 @@ A command-line interface for the [Linq](https://linqapp.com) messaging API. Send
 
 ## Installation
 
+### npm (cross-platform)
+
+Requires Node.js >= 22.
+
+```bash
+npm install -g @linqapp/cli
+```
+
 ### Homebrew (macOS / Linux)
 
 ```bash
diff --git a/package.json b/package.json
index 53d8ddd..0de2089 100644
--- a/package.json
+++ b/package.json
@@ -131,6 +131,7 @@
     "url": "https://github.com/linq-team/linq-cli/issues"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }