diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 8808f52..5c8ea9e 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -79,9 +79,29 @@ jobs:
       - name: Build npm packages
         run: bun run build:npm
 
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; setup-node's bundled npm may be older.
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest
+
+      # No NODE_AUTH_TOKEN: npm detects the GitHub Actions OIDC environment (id-token: write)
+      # and authenticates via the per-package Trusted Publisher configured on npmjs.com.
+      # Provenance is generated automatically for trusted publishing.
+      # Idempotent: skip versions already on npm so a re-run (e.g. after a
+      # partial publish) only pushes the packages still missing, instead of
+      # aborting on the first "cannot publish over previous version".
       - name: Publish to npm
         run: |
-          for dir in npm/code-*; do
-            (cd "$dir" && npm publish --provenance --access public)
-          done
-          cd npm/code && npm publish --provenance --access public
+          set -euo pipefail
+          publish_if_new() {
+            local dir="$1" name ver
+            name=$(cd "$dir" && node -p "require('./package.json').name")
+            ver=$(cd "$dir" && node -p "require('./package.json').version")
+            if npm view "$name@$ver" version >/dev/null 2>&1; then
+              echo "== skip $name@$ver (already published)"
+            else
+              echo "== publish $name@$ver"
+              (cd "$dir" && npm publish --access public)
+            fi
+          }
+          for dir in npm/code-*; do publish_if_new "$dir"; done
+          publish_if_new npm/code