diff --git a/.github/workflows/publish.js.yml b/.github/workflows/publish.js.yml
index 5a324d3..6d1f1c4 100644
--- a/.github/workflows/publish.js.yml
+++ b/.github/workflows/publish.js.yml
@@ -9,6 +9,7 @@ permissions:
   contents: write
   pull-requests: write
   issues: write
+  id-token: write # to enable use of OIDC for trusted publishing and npm provenance
 
 jobs:
   build:
@@ -28,6 +29,5 @@ jobs:
     - run: npx semantic-release
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       name: Release
 
diff --git a/package.json b/package.json
index e8bb609..21a6e1c 100644
--- a/package.json
+++ b/package.json
@@ -78,7 +78,7 @@
     "mocha": "^11.0.1",
     "prettier": "^3.0.0",
     "proxyquire": "^2.1.3",
-    "semantic-release": "^25.0.0",
+    "semantic-release": "^25.0.2",
     "sinon": "^21.0.0",
     "ts-node": "^10.9.1",
     "typescript": "^5.4.3"