diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 198f0bd..32a4c56 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -29,10 +29,12 @@ jobs:
   publish-npm:
     runs-on: ubuntu-latest
     # id-token: write is required in BOTH the caller (release.yml) and here for
-    # npm OIDC trusted publishing.
+    # npm OIDC trusted publishing. Only id-token — the caller (cargo-dist's
+    # custom-publish-npm) grants {id-token, packages}, so requesting `contents`
+    # here would EXCEED the caller and fail workflow validation at startup.
+    # checkout works at contents:none (same as the publish-crates job).
     permissions:
       id-token: write
-      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2