diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 76e93d8..c0d3350 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -9,6 +9,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
@@ -26,12 +27,6 @@ jobs:
         uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 (sdk-node publish)
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Verify npm auth
-        run: npm whoami
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -49,9 +44,9 @@ jobs:
           if echo "$VERSION" | grep -q "-"; then
             TAG=$(echo "$VERSION" | sed 's/.*-\([a-zA-Z]*\).*/\1/')
             echo "Publishing @runwayml/avatars prerelease with --tag $TAG"
-            npm publish --access public --tag "$TAG"
+            npm publish --access public --provenance --tag "$TAG"
           else
-            npm publish --access public
+            npm publish --access public --provenance
           fi
 
       - name: Publish react
@@ -61,7 +56,7 @@ jobs:
           if echo "$VERSION" | grep -q "-"; then
             TAG=$(echo "$VERSION" | sed 's/.*-\([a-zA-Z]*\).*/\1/')
             echo "Publishing @runwayml/avatars-react prerelease with --tag $TAG"
-            npm publish --access public --tag "$TAG"
+            npm publish --access public --provenance --tag "$TAG"
           else
-            npm publish --access public
+            npm publish --access public --provenance
           fi