diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
index a999729..9da4342 100644
--- a/.github/workflows/release-npm.yml
+++ b/.github/workflows/release-npm.yml
@@ -2,7 +2,7 @@
 #
 # Triggered by tags of the form `node-v*`. The build matrix produces the native
 # addons; the publish job ships the per-platform packages and the main package
-# with npm provenance (NPM_TOKEN).
+# with npm provenance via OIDC trusted publishing.
 name: Release (npm)
 
 on:
@@ -71,7 +71,8 @@ jobs:
     name: publish
     needs: build
     if: startsWith(github.ref, 'refs/tags/node-v')
-    # npm provenance is only issued on GitHub-hosted runners.
+    # Runs on a GitHub-hosted runner: npm provenance and the OIDC
+    # trusted-publishing token exchange are both only available there.
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -94,9 +95,11 @@ jobs:
       - name: Distribute artifacts into npm dirs
         run: npx napi artifacts --npm-dir npm --build-output-dir artifacts
 
+      # Trusted publishing needs npm >= 11.5.1; Node's bundled npm may be older.
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@latest
+
       - name: Publish
         run: |
           npx napi pre-publish -t npm --no-gh-release
           npm publish --access public --provenance --ignore-scripts
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/AGENTS.md b/AGENTS.md
index fe3e828..e010d21 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -95,7 +95,7 @@ Five independent trains, each on its own tag prefix:
 
 - `v<semver>` → `release-go.yml` (GoReleaser changelog; the Go module release).
 - `rust-v<semver>` → `release-crate.yml` (crates.io).
-- `node-v<semver>` → `release-npm.yml` (npm, per-platform native addons).
+- `node-v<semver>` → `release-npm.yml` (npm, per-platform native addons; OIDC trusted publishing).
 - `py-v<semver>` → `release-pypi.yml` (PyPI wheels + sdist).
 - `dotnet-v<semver>` → `release-nuget.yml` (nuget.org, Trusted Publishing/OIDC).
   The workflow fails unless the tag's semver matches `<Version>` in