diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 01598a8b..37195dbe 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -73,8 +73,6 @@ jobs:
       - name: Publish
         if: ${{ steps.release.outputs.releases_created == 'true' }}
         run: npm exec -c publish-packages
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: 'Get message'
         if: ${{ steps.release.outputs.releases_created == 'true' }}
@@ -91,3 +89,30 @@ jobs:
           SLACK_USERNAME: Mux Elements
           SLACK_ICON: https://avatars.githubusercontent.com/muxinc?size=48
           SLACK_FOOTER: ''
+
+  canary:
+    # Only publish canaries from main, and never on the Release Please commit
+    # (that path publishes the real release via `release` above).
+    if: ${{ github.ref == 'refs/heads/main' && github.event.commits[0].author.name != 'github-actions[bot]' }}
+
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: read node version from the .nvmrc file
+        run: echo ::set-output name=NODE_VERSION::$(cat .nvmrc)
+        shell: bash
+        id: nvmrc
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{steps.nvmrc.outputs.NODE_VERSION}}
+          # required so npm can publish below
+          registry-url: 'https://registry.npmjs.org'
+          cache: npm
+      - run: npm ci
+      - run: npm run clean
+      - run: npm run build:packages
+      - run: npx --yes -w packages wet-run@1.2.5 release prerelease --prerelease canary --provenance --log-level verbose
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bce6e960..eecdd9b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,8 +14,6 @@ jobs:
 
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    permissions:
-      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -32,10 +30,6 @@ jobs:
       - run: npm ci
       - run: npm run clean
       - run: npm run build:packages
-      - run: npx --yes -w packages wet-run@1.2.5 release prerelease --prerelease canary --provenance --log-level verbose
-        if: ${{ github.ref == 'refs/heads/main' }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   lint:
     # Don't run if the CI is triggered by Release Please