diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3065a97..1a978dc 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -102,6 +102,9 @@ jobs:
       - name: Publish to npm
         if: steps.npm-version.outputs.exists != 'true'
         run: npm publish --access public --ignore-scripts
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/tests/publish-workflow.test.ts b/tests/publish-workflow.test.ts
index 044d06e..03c5323 100644
--- a/tests/publish-workflow.test.ts
+++ b/tests/publish-workflow.test.ts
@@ -10,13 +10,14 @@ describe('release runtime contract', () => {
     expect(ci).toContain('node-version: [24.18.0, 22.13.0]')
   })
 
-  it('publishes through npm trusted publishing without a write token', () => {
+  it('publishes with the repository token and provenance', () => {
     expect(publish).toContain('id-token: write')
     expect(publish).toContain('node-version: 24.18.0')
     expect(publish).toContain('registry-url: https://registry.npmjs.org')
     expect(publish).toContain('package-manager-cache: false')
     expect(publish).toContain('npm publish --access public --ignore-scripts')
-    expect(publish).not.toContain('NODE_AUTH_TOKEN')
+    expect(publish).toContain('NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}')
+    expect(publish).toContain("NPM_CONFIG_PROVENANCE: 'true'")
     expect(publish).not.toContain('pnpm publish')
   })
 })