diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8a69193..ecdf61e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,6 +32,16 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
 
+      - name: Install npm 11.5.1+ for OIDC trusted publishing
+        # pnpm publish shells out to the npm CLI for the registry PUT.
+        # Node 22's bundled npm (10.9.7) cannot perform OIDC trusted
+        # publishing and fails with a misleading "E404 not in this
+        # registry". Pin npm to 11.5.1 (first version with working TP-OIDC).
+        # --force gets past Node 22's bundled-npm arborist on the upgrade.
+        run: |
+          npm install -g npm@11.5.1 --force
+          npm --version
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile