diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index db8ff14..63a6a34 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,26 +23,29 @@ on:
       - "**"
   workflow_dispatch:
 
+permissions:
+  id-token: write # for publishing to npm
+  contents: read
+
 jobs:
-  # Run tests using node, publish a package when tagged
   # https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
 
   publish-npm:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v5
         with:
-          node-version: "20"
+          node-version: "22"
           registry-url: https://registry.npmjs.org/
+      - name: make sure npm is up-to-date
+        run: npm install --global npm@latest
       - run: npm ci
       - run: npm publish
         if: startsWith(github.ref, 'refs/tags/')
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.npm_token }}
 
   publish-docker:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5