diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index eb69b29..d91f87d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -59,10 +59,11 @@ jobs:
             fs.writeFileSync('release-notes.md', lines.slice(start + 1, end).join('\n').trim() + '\n');
           "
 
+      # Auth is npm Trusted Publishing (OIDC): the registry trusts this
+      # repo + workflow file via `id-token: write` above, so no NPM_TOKEN.
+      # A token in NODE_AUTH_TOKEN would take precedence and bypass OIDC.
       - name: Publish package
         run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub Release (creates the tag on workflow_dispatch)
         uses: softprops/action-gh-release@v3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2a1044..04e6b15 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.7.1 (2026-11-09)
+
+Republish — no code changes. npm releases now go through Trusted Publishing
+(OIDC from `publish.yml`) instead of a long-lived token; this version is the
+one that validates the connection.
+/ 재배포 — 코드 무변경. npm 발행이 토큰 대신 Trusted Publishing(OIDC)으로
+전환되었고, 이 버전이 그 연결을 검증합니다.
+
 ## 0.7.0 (2026-11-08)
 
 ### Added
diff --git a/package-lock.json b/package-lock.json
index 2f97edb..fdb3597 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@devslab/numkey",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@devslab/numkey",
-      "version": "0.7.0",
+      "version": "0.7.1",
       "license": "MIT",
       "devDependencies": {
         "@devslab/site-kit": "0.8.0",
diff --git a/package.json b/package.json
index 2c0bce1..df778f0 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@devslab/numkey",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "publishConfig": {
     "access": "public"
   },