diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 47c0aeb..030d7c1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,6 +5,12 @@ on:
   push:
     tags:
       - v*
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
 
 jobs:
   npm:
@@ -18,6 +24,8 @@ jobs:
         with:
           node-version: '22'
           registry-url: https://registry.npmjs.org
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
       - name: Check version
         id: version
         shell: bash
@@ -33,8 +41,6 @@ jobs:
       - name: Publish ${{ steps.version.outputs.name }}@${{ steps.version.outputs.current }}
         if: ${{ steps.version.outputs.published != steps.version.outputs.current }}
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   github:
     runs-on: ubuntu-latest
     timeout-minutes: 30