diff --git a/.github/workflows/publish.js.yml b/.github/workflows/publish.js.yml
index 22293a9..6c0796a 100644
--- a/.github/workflows/publish.js.yml
+++ b/.github/workflows/publish.js.yml
@@ -9,6 +9,7 @@ permissions:
   contents: write
   pull-requests: write
   issues: write
+  id-token: write # to enable use of OIDC for trusted publishing and npm provenance
 
 jobs:
   build:
@@ -35,6 +36,5 @@ jobs:
     - run: npx semantic-release
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       name: Release
 
diff --git a/package.json b/package.json
index 42c89fb..9216df9 100644
--- a/package.json
+++ b/package.json
@@ -90,7 +90,7 @@
     "chai-as-promised": "^8.0.0",
     "conventional-changelog-conventionalcommits": "^9.0.0",
     "mocha": "^11.0.1",
-    "semantic-release": "^25.0.0",
+    "semantic-release": "^25.0.2",
     "sinon": "^21.0.0",
     "ts-node": "^10.9.1",
     "typescript": "^5.4.2",