diff --git a/.changeset/lazy-toes-look.md b/.changeset/lazy-toes-look.md
new file mode 100644
index 0000000000..1fb37e6bc0
--- /dev/null
+++ b/.changeset/lazy-toes-look.md
@@ -0,0 +1,15 @@
+---
+"@gitbook/react-contentkit": patch
+"@gitbook/openapi-parser": patch
+"@gitbook/browser-types": patch
+"@gitbook/react-openapi": patch
+"@gitbook/cache-tags": patch
+"@gitbook/react-math": patch
+"@gitbook/colors": patch
+"@gitbook/embed": patch
+"@gitbook/fonts": patch
+"@gitbook/icons": patch
+"@gitbook/expr": patch
+---
+
+Use NPM Trusted publishing for publishing the package.
diff --git a/.changeset/social-friends-press.md b/.changeset/social-friends-press.md
new file mode 100644
index 0000000000..7c3799c179
--- /dev/null
+++ b/.changeset/social-friends-press.md
@@ -0,0 +1,5 @@
+---
+"@gitbook/expr": patch
+---
+
+Use NPM dependency for eval-estree-expression
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 6a57c340cc..3804f8cc9c 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -5,8 +5,12 @@ on:
         branches:
             - main
 
+permissions:
+    id-token: write
+    contents: read
+
 env:
-    BUN_NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    BUN_NPM_TOKEN: ${{ secrets.NPM_TOKEN_READONLY }}
     
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
@@ -30,12 +34,10 @@ jobs:
               id: changesets
               uses: changesets/action@v1
               with:
-                  publish: npm run release
+                  publish: npm run publish-all-packages
                   version: npm run changeset-version
               env:
                   # Using a PAT instead of GITHUB_TOKEN because we need to run workflows when releases are created
                   # https://github.com/orgs/community/discussions/26875#discussioncomment-3253761
                   GITHUB_TOKEN: ${{ secrets.GH_PERSONAL_TOKEN }}
-                  CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-                  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
 
diff --git a/.gitignore b/.gitignore
index 91d78cafe7..56824a05dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,4 +25,7 @@ yarn-error.log*
 
 # TypeScript
 *.tsbuildinfo
-.npmrc
\ No newline at end of file
+.npmrc
+
+# Bun pack artifacts
+packages/*/*.tgz
diff --git a/bun.lock b/bun.lock
index 7667d78ced..bfa95c2724 100644
--- a/bun.lock
+++ b/bun.lock
@@ -80,7 +80,7 @@
         "acorn-walk": "^8.3.4",
         "assert-never": "catalog:",
         "escodegen": "^2.1.0",
-        "eval-estree-expression": "github:jonschlinkert/eval-estree-expression#9cf28d2",
+        "eval-estree-expression": "github:jonschlinkert/eval-estree-expression#fb0246a",
       },
       "devDependencies": {
         "@tsconfig/node20": "catalog:",
@@ -1951,7 +1951,7 @@
 
     "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="],
 
-    "eval-estree-expression": ["eval-estree-expression@github:jonschlinkert/eval-estree-expression#9cf28d2", {}, "jonschlinkert-eval-estree-expression-9cf28d2"],
+    "eval-estree-expression": ["eval-estree-expression@github:jonschlinkert/eval-estree-expression#fb0246a", {}, "jonschlinkert-eval-estree-expression-fb0246a"],
 
     "event-emitter": ["event-emitter@0.3.5", "", { "dependencies": { "d": "1", "es5-ext": "~0.10.14" } }, "sha512-D9rRn9y7kLPnJ+hMq7S/nhvoKwwvVJahBi2BPmx3bvbsEdK3W9ii8cBSGjP+72/LnM4n6fo3+dkCX5FeTQruXA=="],
 
diff --git a/package.json b/package.json
index bf3f46eedd..46d7019796 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
         "turbo": "^2.5.8",
         "vercel": "^39.4.2"
     },
-    "packageManager": "bun@1.3.0",
+    "packageManager": "bun@1.3.2",
     "overrides": {
         "@codemirror/state": "6.4.1",
         "@types/react": "catalog:",
@@ -32,8 +32,7 @@
         "e2e-customers": "turbo run e2e-customers",
         "changeset": "changeset",
         "changeset-version": "changeset version && bun run format && bun update",
-        "release": "turbo run release && bun run publish-all-packages",
-        "publish-all-packages": "for dir in packages/*; do (cd \"$dir\" && bun publish || true); done && changeset tag",
+        "publish-all-packages": "turbo run publish-to-npm",
         "download:env": "op read op://gitbook-x-dev/gitbook-open/.env.local >> .env.local",
         "clean": "turbo run clean"
     },
diff --git a/packages/browser-types/package.json b/packages/browser-types/package.json
index 89f8b7a4e2..8a2219471f 100644
--- a/packages/browser-types/package.json
+++ b/packages/browser-types/package.json
@@ -22,7 +22,8 @@
     "scripts": {
         "build": "tsdown",
         "typecheck": "tsc --noEmit",
-        "dev": "bun run build -- --watch ./src"
+        "dev": "bun run build -- --watch ./src",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "README.md", "CHANGELOG.md"],
     "publishConfig": {
diff --git a/packages/cache-tags/package.json b/packages/cache-tags/package.json
index a246b261fc..9f0817c8ad 100644
--- a/packages/cache-tags/package.json
+++ b/packages/cache-tags/package.json
@@ -21,7 +21,8 @@
     "scripts": {
         "build": "tsdown",
         "typecheck": "tsc --noEmit",
-        "dev": "bun run build -- --watch ./src"
+        "dev": "bun run build -- --watch ./src",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "README.md", "CHANGELOG.md"],
     "publishConfig": {
diff --git a/packages/colors/package.json b/packages/colors/package.json
index af4b32d87a..236b6dc6ec 100644
--- a/packages/colors/package.json
+++ b/packages/colors/package.json
@@ -17,7 +17,8 @@
     "scripts": {
         "build": "tsdown",
         "typecheck": "tsc --noEmit",
-        "dev": "bun run build -- --watch ./src"
+        "dev": "bun run build -- --watch ./src",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "README.md", "CHANGELOG.md"],
     "publishConfig": {
diff --git a/packages/embed/package.json b/packages/embed/package.json
index a266c985ec..92000f6989 100644
--- a/packages/embed/package.json
+++ b/packages/embed/package.json
@@ -34,7 +34,8 @@
         "build-standalone": "bun build src/standalone/index.ts --bundle --minify --outdir=standalone",
         "clean": "rm -rf ./dist",
         "typecheck": "tsc --noEmit",
-        "dev": "bun run build -- --watch ./src"
+        "dev": "bun run build -- --watch ./src",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "README.md", "CHANGELOG.md"],
     "publishConfig": {
diff --git a/packages/expr/package.json b/packages/expr/package.json
index 9a3101d96b..da1bae5510 100644
--- a/packages/expr/package.json
+++ b/packages/expr/package.json
@@ -16,7 +16,7 @@
         "acorn-walk": "^8.3.4",
         "assert-never": "catalog:",
         "escodegen": "^2.1.0",
-        "eval-estree-expression": "github:jonschlinkert/eval-estree-expression#9cf28d2"
+        "eval-estree-expression": "github:jonschlinkert/eval-estree-expression#fb0246a"
     },
     "devDependencies": {
         "@tsconfig/strictest": "catalog:",
@@ -33,7 +33,8 @@
         "typecheck": "tsc --noEmit",
         "unit": "bun test",
         "clean": "rm -rf ./dist",
-        "dev": "bun run build -- --watch ./src"
+        "dev": "bun run build -- --watch ./src",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "README.md", "CHANGELOG.md"],
     "publishConfig": {
diff --git a/packages/fonts/package.json b/packages/fonts/package.json
index 4471679b58..5b953c9455 100644
--- a/packages/fonts/package.json
+++ b/packages/fonts/package.json
@@ -24,7 +24,8 @@
         "typecheck": "tsc --noEmit",
         "dev": "bun run build -- --watch ./src",
         "clean": "rm -rf ./dist && rm -rf ./src/data",
-        "unit": "bun test"
+        "unit": "bun test",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "bin", "README.md", "CHANGELOG.md"],
     "engines": {
diff --git a/packages/icons/package.json b/packages/icons/package.json
index a13c5f394d..51b71b7c6d 100644
--- a/packages/icons/package.json
+++ b/packages/icons/package.json
@@ -39,7 +39,8 @@
         "typecheck": "tsc --noEmit",
         "dev": "bun run build -- --watch ./src",
         "clean": "rm -rf ./dist && rm -rf ./src/data",
-        "unit": "bun test"
+        "unit": "bun test",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "bin": {
         "gitbook-icons": "./bin/gitbook-icons.js"
diff --git a/packages/openapi-parser/package.json b/packages/openapi-parser/package.json
index f1658266bc..18d7472b6a 100644
--- a/packages/openapi-parser/package.json
+++ b/packages/openapi-parser/package.json
@@ -28,7 +28,8 @@
         "typecheck": "tsc --noEmit",
         "unit": "bun test",
         "dev": "bun run build -- --watch ./src",
-        "clean": "rm -rf ./dist"
+        "clean": "rm -rf ./dist",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "README.md", "CHANGELOG.md"],
     "publishConfig": {
diff --git a/packages/react-contentkit/package.json b/packages/react-contentkit/package.json
index ef3a239072..288debe030 100644
--- a/packages/react-contentkit/package.json
+++ b/packages/react-contentkit/package.json
@@ -28,7 +28,8 @@
         "build": "tsdown",
         "typecheck": "tsc --noEmit",
         "dev": "bun run build -- --watch ./src",
-        "clean": "rm -rf ./dist"
+        "clean": "rm -rf ./dist",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "README.md", "CHANGELOG.md"],
     "publishConfig": {
diff --git a/packages/react-math/package.json b/packages/react-math/package.json
index 6232f983f6..27a91bef16 100644
--- a/packages/react-math/package.json
+++ b/packages/react-math/package.json
@@ -30,7 +30,8 @@
         "build": "tsdown",
         "typecheck": "tsc --noEmit",
         "dev": "bun run build -- --watch ./src",
-        "clean": "rm -rf ./dist"
+        "clean": "rm -rf ./dist",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "bin": {
         "gitbook-math": "./bin/gitbook-math.js"
diff --git a/packages/react-openapi/package.json b/packages/react-openapi/package.json
index 8bd50026b2..e636fae2d8 100644
--- a/packages/react-openapi/package.json
+++ b/packages/react-openapi/package.json
@@ -50,7 +50,8 @@
         "typecheck": "tsc --noEmit",
         "unit": "bun test",
         "dev": "bun run build -- --watch ./src",
-        "clean": "rm -rf ./dist"
+        "clean": "rm -rf ./dist",
+        "publish-to-npm": "../../scripts/publish-if-new.sh"
     },
     "files": ["dist", "README.md", "CHANGELOG.md"],
     "publishConfig": {
diff --git a/scripts/publish-if-new.sh b/scripts/publish-if-new.sh
new file mode 100755
index 0000000000..215fd2b787
--- /dev/null
+++ b/scripts/publish-if-new.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+NAME=$(node -p "require('./package.json').name")
+VERSION=$(node -p "require('./package.json').version")
+
+if npm view "${NAME}@${VERSION}" >/dev/null 2>&1; then
+    echo "${NAME}@${VERSION} already published, skipping."
+    exit 0
+fi
+
+TARBALL=$(bun pm pack --quiet --dirname ./.publish)
+
+npm publish "${TARBALL}" --no-workspaces
+
diff --git a/turbo.json b/turbo.json
index 27d0f9b0a6..e36f300540 100644
--- a/turbo.json
+++ b/turbo.json
@@ -53,10 +53,10 @@
             "cache": false,
             "dependsOn": ["generate", "^build"]
         },
-        // Script run when the package is deployed
-        "release": {
-            "dependsOn": ["^release", "build"],
-            "env": ["CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_API_TOKEN"]
+        // Publish the package to npm
+        "publish-to-npm": {
+            "dependsOn": ["build"],
+            "cache": false
         },
         // Clean up the package
         "clean": {