diff --git a/.github/workflows/npmpublish.yml b/.github/workflows/npmpublish.yml
index a7b1038..b17ed95 100644
--- a/.github/workflows/npmpublish.yml
+++ b/.github/workflows/npmpublish.yml
@@ -1,46 +1,26 @@
 name: Publish Package
 
 on:
-  release:
-    types: [created]
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
 
 jobs:
   publish:
     runs-on: ubuntu-latest
-    env:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 'lts/*'
-          registry-url: https://registry.npmjs.org/
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: make install
-
-      - name: Build project
-        run: make build
-
-      - name: Run linting
-        run: make lint
-
-      - name: Run tests
-        run: make test
-
-      - name: Publish package
-        if: ${{ env.NPM_TOKEN != '' }}
-        run: make publish
-        env:
-          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
-
-      - name: Publish package (legacy token fallback)
-        if: ${{ env.NPM_TOKEN == '' }}
-        run: make publish
-        env:
-          NODE_AUTH_TOKEN: ${{ env.NPM_AUTH_TOKEN }}
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false  # never use caching in release builds
+      - run: npm ci
+      - run: npm run build --if-present
+      - run: npm test
+      - run: npm publish