diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b128008..2add059 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,9 +39,11 @@ jobs:
       - name: Build project
         run: pnpm build
 
+      # Publishing uses npm Trusted Publishing (OIDC) via the `id-token: write`
+      # permission above — no NPM_TOKEN. release-it-pnpm runs `pnpm publish`,
+      # and Node 24 ships npm >= 11.5.1, which is required for OIDC publishing.
       - name: Create Release and Publish
         run: pnpm release
         env:
           GITHUB_TOKEN: ${{ secrets.GH_PAT }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
diff --git a/.nvmrc b/.nvmrc
index 8fdd954..a45fd52 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22
\ No newline at end of file
+24