diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 8b9322b..856a21c 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -1,8 +1,14 @@
 name: Publish Package
+
 on:
   push:
     branches:
       - main
+
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   npm-publish:
     name: publish-npm
@@ -18,11 +24,17 @@ jobs:
         uses: actions/setup-node@v6
         with:
           node-version: 20
-          registry-url: "https://registry.npmjs.org"
-          cache: "yarn"
+          registry-url: https://registry.npmjs.org
+          cache: yarn
+
+      - name: Install dependencies
+        run: yarn --frozen-lockfile
+
+      - name: Typecheck
+        run: yarn tsc
 
-      - run: yarn --frozen-lockfile
-      - run: yarn tsc
-      - run: yarn build
+      - name: Build package
+        run: yarn build
 
-      - run: yarn publish
+      - name: Publish to npm
+        run: npm publish --provenance --access public