diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index be887d5f..516b75cf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,6 +19,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -31,11 +32,15 @@ jobs:
         with:
           node-version: 24
           cache: pnpm
-          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # changesets/action writes ~/.npmrc from NPM_TOKEN if that file is missing.
+      # A token-backed npmrc forces OTP (EOTP). Trusted publishing uses OIDC instead.
+      - name: Use OIDC for npm publish
+        run: printf 'registry=https://registry.npmjs.org/\n' > "$HOME/.npmrc"
+
       - name: Create Release Pull Request or Publish
         uses: changesets/action@v1
         with:
@@ -44,5 +49,3 @@ jobs:
           commit: "chore: version packages"
         env:
           GITHUB_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}