diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9dd23f1..394d1c4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,28 +1,33 @@
 name: release
 
+# Release: tag v* to publish `interscript-ts` to npm via TRUSTED PUBLISHING
+# (OIDC — no long-lived tokens).
+#
+# One-time manual setup:
+#   1. Manually publish ONCE (npm publish --access public)
+#   2. On npmjs.com: Settings → Trusted publishing → GitHub Actions →
+#      org `interscript`, repo `interscript-ts`, workflow `release.yml`
+
 on:
   push:
-    tags:
-      - "v*"
+    tags: ['v*']
 
 permissions:
+  id-token: write
   contents: read
-  id-token: write  # required for npm provenance
 
 jobs:
-  publish:
+  release:
     runs-on: ubuntu-latest
-    environment: release
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
         with:
-          node-version: "22"
-          cache: npm
+          node-version: '24'
           registry-url: https://registry.npmjs.org
+
       - run: npm ci
       - run: npm run build
       - run: npm test
-      - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.INTERSCRIPT_NPM_TOKEN }}
+      - run: npm publish --access public