diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bfd6579..6502636 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,6 +27,9 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: npm
 
+      - name: Upgrade npm to a version that supports Trusted Publishing
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
@@ -38,11 +41,9 @@ jobs:
 
       - name: Publish CLI
         working-directory: packages/cli
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.dry_run }}" = "true" ]; then
-            npm publish --dry-run
+            npm publish --dry-run --provenance --access public
           else
-            npm publish
+            npm publish --provenance --access public
           fi