diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 915140f..e4f24f0 100755
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -54,8 +54,10 @@ jobs:
           registry-url: https://registry.npmjs.org
       # npm 11.21 supports private dist-tag reads through trusted publishing.
       - run: npm install --global npm@11.21.0
-      - name: Check trusted publisher access
+      - name: Check npm publishing access
         run: npm dist-tag ls @dev.smartpricing/traceflow-sdk --json
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NO_TWOFA_NPM_TOKEN }}
 
       # Kafka is needed only for its declarations; do not build its native addon.
       - run: npm ci --ignore-scripts
@@ -64,11 +66,15 @@ jobs:
       - name: Verify the npm archive
         run: npm run test:package -- "$RUNNER_TEMP/traceflow-sdk.tgz"
 
-      - name: Publish to npm with trusted publishing
+      - name: Publish to npm
         run: npm publish "$RUNNER_TEMP/traceflow-sdk.tgz" --tag latest
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NO_TWOFA_NPM_TOKEN }}
 
       - name: Verify published latest version
         # OIDC supports dist-tag, but npm view needs a separate read token for private packages.
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NO_TWOFA_NPM_TOKEN }}
         run: |
           node --input-type=module <<'NODE'
           import assert from 'node:assert/strict';
diff --git a/js/README.md b/js/README.md
index 0af163b..e3030d2 100644
--- a/js/README.md
+++ b/js/README.md
@@ -208,7 +208,15 @@ archive, then publishes that same archive. It verifies npm's `latest` tag after
 publishing. The existing `release/X.Y.Z` flow is also supported: commit version
 `X.Y.Z` before pushing. The workflow does not bump versions or merge branches.
 
-### One-time npm setup
+### npm authentication
+
+The workflow uses `NPM_TOKEN` (organization or repository secret), falling back
+to the legacy repository secret `NO_TWOFA_NPM_TOKEN`. Organization secrets must
+allow access to this public repository; the "private repositories" policy does
+not include it. Use a valid token with read/write permission for this package and permission to
+publish non-interactively. Update the secret when the token expires or is revoked.
+
+To remove the need to renew a publishing token, configure trusted publishing:
 
 In the package's npm settings, add a **Trusted Publisher** for GitHub Actions:
 
@@ -221,8 +229,8 @@ In the package's npm settings, add a **Trusted Publisher** for GitHub Actions:
 [Trusted publishing](https://docs.npmjs.com/trusted-publishers/) authenticates
 through GitHub OIDC, so no npm write token or periodic token rotation is needed.
 The workflow uses npm 11.21+ so it can verify private package tags through OIDC.
-It does not change package visibility. The old `NO_TWOFA_NPM_TOKEN` secret is no
-longer used.
+It does not change package visibility. npm prefers OIDC when configured and can
+fall back to the available npm token while trusted publishing is being set up.
 
 To verify packaging locally, run from `js/`: