diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4a9b65..51dd999 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,6 +81,9 @@ jobs:
             GIT_AUTHOR_EMAIL: developers@mparticle.com
             GIT_COMMITTER_NAME: mparticle-automation
             GIT_COMMITTER_EMAIL: developers@mparticle.com
+            # npm auth: no trusted publisher is configured on npmjs for this package,
+            # so publish authenticates with the org token (provenance still attested via OIDC).
+            NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
 
         steps:
             - name: Checkout public main branch