diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c0b63fb..fc36964 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,10 +16,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # No registry-url here: with it, setup-node writes an .npmrc with a
+      # placeholder NODE_AUTH_TOKEN and npm uses that instead of OIDC.
       - uses: actions/setup-node@v4
         with:
           node-version: 22.x
-          registry-url: https://registry.npmjs.org
           cache: npm
 
       # Trusted publishing (OIDC) needs npm 11.5.1 or newer; Node 22 ships an older npm.
@@ -32,3 +33,6 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --access public
+        env:
+          # Surfaces the "oidc" log lines that explain a failed token exchange.
+          NPM_CONFIG_LOGLEVEL: verbose