diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index edfd02e..7c78179 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,7 +15,9 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 24.x
+          # Pinned to a minor that ships npm >=11.5.1 (required for OIDC
+          # trusted publishing). Bump deliberately, not implicitly via 24.x.
+          node-version: 24.14.x
           cache: npm
       - run: npm ci
       - run: npm run build