diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md
index a4bfa4c4471b8..53277665f2dc6 100644
--- a/DEPENDENCIES.md
+++ b/DEPENDENCIES.md
@@ -53,12 +53,12 @@ graph LR;
   libnpmpack-->npmcli-run-script["@npmcli/run-script"];
   libnpmpack-->npmcli-template-oss["@npmcli/template-oss"];
   libnpmpack-->pacote;
-  libnpmpublish-->normalize-package-data;
   libnpmpublish-->npm-package-arg;
   libnpmpublish-->npm-registry-fetch;
   libnpmpublish-->npmcli-eslint-config["@npmcli/eslint-config"];
   libnpmpublish-->npmcli-mock-globals["@npmcli/mock-globals"];
   libnpmpublish-->npmcli-mock-registry["@npmcli/mock-registry"];
+  libnpmpublish-->npmcli-package-json["@npmcli/package-json"];
   libnpmpublish-->npmcli-template-oss["@npmcli/template-oss"];
   libnpmpublish-->proc-log;
   libnpmpublish-->semver;
@@ -375,12 +375,12 @@ graph LR;
   libnpmpack-->spawk;
   libnpmpack-->tap;
   libnpmpublish-->ci-info;
-  libnpmpublish-->normalize-package-data;
   libnpmpublish-->npm-package-arg;
   libnpmpublish-->npm-registry-fetch;
   libnpmpublish-->npmcli-eslint-config["@npmcli/eslint-config"];
   libnpmpublish-->npmcli-mock-globals["@npmcli/mock-globals"];
   libnpmpublish-->npmcli-mock-registry["@npmcli/mock-registry"];
+  libnpmpublish-->npmcli-package-json["@npmcli/package-json"];
   libnpmpublish-->npmcli-template-oss["@npmcli/template-oss"];
   libnpmpublish-->proc-log;
   libnpmpublish-->semver;
diff --git a/package-lock.json b/package-lock.json
index 2faf802e458a2..815ae9a23112a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -89,7 +89,7 @@
         "@npmcli/config": "^10.3.0",
         "@npmcli/fs": "^4.0.0",
         "@npmcli/map-workspaces": "^4.0.2",
-        "@npmcli/package-json": "^6.1.1",
+        "@npmcli/package-json": "^6.2.0",
         "@npmcli/promise-spawn": "^8.0.2",
         "@npmcli/redact": "^3.1.1",
         "@npmcli/run-script": "^9.1.0",
@@ -19132,8 +19132,8 @@
       "version": "11.0.0",
       "license": "ISC",
       "dependencies": {
+        "@npmcli/package-json": "^6.2.0",
         "ci-info": "^4.0.0",
-        "normalize-package-data": "^7.0.0",
         "npm-package-arg": "^12.0.0",
         "npm-registry-fetch": "^18.0.1",
         "proc-log": "^5.0.0",
diff --git a/package.json b/package.json
index 976098ad04750..628198d927098 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
     "@npmcli/config": "^10.3.0",
     "@npmcli/fs": "^4.0.0",
     "@npmcli/map-workspaces": "^4.0.2",
-    "@npmcli/package-json": "^6.1.1",
+    "@npmcli/package-json": "^6.2.0",
     "@npmcli/promise-spawn": "^8.0.2",
     "@npmcli/redact": "^3.1.1",
     "@npmcli/run-script": "^9.1.0",
diff --git a/workspaces/libnpmpublish/lib/publish.js b/workspaces/libnpmpublish/lib/publish.js
index 93d546efb5f0e..001dff8de87f0 100644
--- a/workspaces/libnpmpublish/lib/publish.js
+++ b/workspaces/libnpmpublish/lib/publish.js
@@ -1,6 +1,6 @@
-const { fixer } = require('normalize-package-data')
 const npmFetch = require('npm-registry-fetch')
 const npa = require('npm-package-arg')
+const PackageJson = require('@npmcli/package-json')
 const { log } = require('proc-log')
 const semver = require('semver')
 const { URL } = require('node:url')
@@ -31,7 +31,7 @@ Remove the 'private' field from the package.json to publish it.`),
   }
 
   const reg = npmFetch.pickRegistry(spec, opts)
-  const pubManifest = patchManifest(manifest, opts)
+  const pubManifest = await patchManifest(manifest, opts)
 
   // registry-frontdoor cares about the access level,
   // which is only configurable for scoped packages
@@ -62,17 +62,18 @@ Remove the 'private' field from the package.json to publish it.`),
   return res
 }
 
-const patchManifest = (_manifest, opts) => {
+const patchManifest = async (_manifest, opts) => {
   const { npmVersion } = opts
-  // we only update top-level fields, so a shallow clone is fine
-  const manifest = { ..._manifest }
-
-  manifest._nodeVersion = process.versions.node
-  if (npmVersion) {
-    manifest._npmVersion = npmVersion
+  const steps = ['fixName']
+  const manifestInput = { ..._manifest, _nodeVersion: process.versions.node }
+  if (npmVersion != null) {
+    manifestInput._npmVersion = npmVersion
   }
+  const manifest = await new PackageJson()
+    .fromContent(manifestInput)
+    .normalize({ steps })
+    .then(p => p.content)
 
-  fixer.fixNameField(manifest, { strict: true, allowLegacyCase: true })
   const version = semver.clean(manifest.version)
   if (!version) {
     throw Object.assign(
diff --git a/workspaces/libnpmpublish/package.json b/workspaces/libnpmpublish/package.json
index 87526bdd88ca0..25715bb0ad5a6 100644
--- a/workspaces/libnpmpublish/package.json
+++ b/workspaces/libnpmpublish/package.json
@@ -38,8 +38,8 @@
   "bugs": "https://github.com/npm/cli/issues",
   "homepage": "https://npmjs.com/package/libnpmpublish",
   "dependencies": {
+    "@npmcli/package-json": "^6.2.0",
     "ci-info": "^4.0.0",
-    "normalize-package-data": "^7.0.0",
     "npm-package-arg": "^12.0.0",
     "npm-registry-fetch": "^18.0.1",
     "proc-log": "^5.0.0",