diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b7c351f..9c5ad2b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: 🍔 Setup bun
         uses: oven-sh/setup-bun@v1
@@ -29,18 +29,23 @@ jobs:
       ${{ github.repository == 'epicweb-dev/remember' &&
       contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/alpha',
       github.ref) && github.event_name == 'push' }}
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      id-token: write # to enable use of OIDC for npm provenance
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
     steps:
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
         # I'd prefer to use bun, but I got this error when I tried using bunx instead of npx:
         # error TS5042: Option 'project' cannot be mixed with source files on a command line.
         # error: "tsc" exited with code 1 (SIGHUP)
         # Also, I don't know how to use bun instead of node for semantic-release 🤷‍♂️
       - name: ⎔ Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: lts/*
 
       - name: 📥 Download deps
         uses: bahmutov/npm-install@v1
@@ -54,9 +59,9 @@ jobs:
           nodenext --target es2022 --outDir . index.js
 
       - name: 🚀 Release
-        uses: cycjimmy/semantic-release-action@v3.2.0
+        uses: cycjimmy/semantic-release-action@v5.0.2
         with:
-          semantic_version: 17
+          semantic_version: 25
           branches: |
             [
               '+([0-9])?(.{+([0-9]),x}).x',
@@ -68,4 +73,3 @@ jobs:
             ]
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}