diff --git a/.github/workflows/node.yaml b/.github/workflows/node.yaml
index 1e3ff04..8ea18a0 100644
--- a/.github/workflows/node.yaml
+++ b/.github/workflows/node.yaml
@@ -145,6 +145,8 @@ jobs:
 
       - name: Publish
         working-directory: node
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           npm ci --ignore-scripts
           npx napi pre-publish -t npm
diff --git a/Cargo.lock b/Cargo.lock
index 72f7efe..de71815 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1379,7 +1379,7 @@ dependencies = [
 
 [[package]]
 name = "murk-cli"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "age",
  "assert_cmd",
@@ -1409,7 +1409,7 @@ dependencies = [
 
 [[package]]
 name = "murk-napi"
-version = "0.5.7"
+version = "0.5.8"
 dependencies = [
  "murk-cli",
  "napi",
diff --git a/Cargo.toml b/Cargo.toml
index 677ccfd..8657b8f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ exclude = ["fuzz"]
 
 [package]
 name = "murk-cli"
-version = "0.5.7"
+version = "0.5.8"
 edition = "2024"
 rust-version = "1.89"
 description = "Encrypted secrets manager for developers — one file, age encryption, git-friendly"
diff --git a/node/Cargo.toml b/node/Cargo.toml
index 88690bb..017d7ba 100644
--- a/node/Cargo.toml
+++ b/node/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "murk-napi"
-version = "0.5.7"
+version = "0.5.8"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/node/package-lock.json b/node/package-lock.json
index c587d87..f55e829 100644
--- a/node/package-lock.json
+++ b/node/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@iicky/murk-secrets",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@iicky/murk-secrets",
-      "version": "0.5.7",
+      "version": "0.5.8",
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
         "@biomejs/biome": "^2.4.9",
diff --git a/node/package.json b/node/package.json
index b0ed502..8258946 100644
--- a/node/package.json
+++ b/node/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@iicky/murk-secrets",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Node.js/TypeScript bindings for murk — encrypted secrets manager",
   "main": "index.js",
   "types": "index.d.ts",