diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
index cf2861f..08bb5f7 100644
--- a/.github/workflows/release-npm.yml
+++ b/.github/workflows/release-npm.yml
@@ -35,8 +35,6 @@ jobs:
       version: ${{ inputs.version }}
       commit: ${{ inputs.commit }}
       environment: release
-    secrets:
-      registry-token: ${{ secrets.NPM_FIRST_PUBLISH_TOKEN }}
 
   dependents:
     needs: release
diff --git a/README.md b/README.md
index a62a777..cd491f5 100644
--- a/README.md
+++ b/README.md
@@ -258,8 +258,7 @@ Runs of different filters go side by side; a second run of the same `ref` and `f
 
 ## Releases
 
-The packages, `@noldova/checkpoints`, `@noldova/checkpoints.protocol` and the Git packages, `@noldova/checkpoints.git.<platform>-<arch>` for each target in `src/noldova.checkpoints.git/builds.json`, are published to npm by the "Release npm packages" workflow, `.github/workflows/release-npm.yml`, and a release never deletes a published version.
-The first publish uses a one-time token that only the `release` environment holds, `NPM_FIRST_PUBLISH_TOKEN`, since npm's trusted publishing needs each package to exist; every later publish uses trusted publishing, so no token is stored.
+The packages, `@noldova/checkpoints`, `@noldova/checkpoints.protocol` and the Git packages, `@noldova/checkpoints.git.<platform>-<arch>` for each target in `src/noldova.checkpoints.git/builds.json`, are published to npm by the "Release npm packages" workflow, `.github/workflows/release-npm.yml`, through npm's trusted publishing, so no token is stored, and a release never deletes a published version.
 A maintainer starts it by hand with the version, which `version.json` and the root `package.json` hold, and the full hash of the commit on `main` to release; the version changes in a pull request before its release, in the Git packages' committed manifests too.
 It calls the organization's shared npm release workflow, pinned to a full commit SHA, whose README says what each job does, in the `release` environment; after the release, its dependents job calls the organization's shared `update-dependents.yml` with the version and the commit.
 The shared workflow reads the version from `version.json`, checks that the commit is on `main` and holds it, tags the commit, runs `npm ci` and `npm run build`, checks the archives in `_packages` with its pipelines tool, which lists the packages from the `package.json` files committed under `src`, so each Git package's manifest is committed as `src/noldova.checkpoints.git/packages/<target>/package.json`, and publishes them.