diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 53b36e6..36370e3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,26 +1,26 @@
-name: Publish
+name: Publish Package
 
 on:
-  push:
-    tags:
-      - 'v*'
+    push:
+        tags:
+            - 'v*'
 
 permissions:
-  id-token: write
+    id-token: write  # Required for OIDC
+    contents: read
 
 jobs:
-  publish:
-    runs-on: ubuntu-latest
+    publish:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v6
 
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20.x'
-          cache: npm
-
-      - run: npm ci
-      - run: npm test
-      - run: npm run build
-      - run: npm publish --provenance --access public
+            - uses: actions/setup-node@v6
+              with:
+                  node-version: '24'
+                  registry-url: 'https://registry.npmjs.org'
+                  package-manager-cache: false  # never use caching in release builds
+            - run: npm ci
+            - run: npm run build --if-present
+            - run: npm test
+            - run: npm publish  # Or: npm stage publish