diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d9940710..4b13a56d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,7 +5,8 @@ on:
     types: [released]
 
 permissions:
-  id-token: write  # Required for OIDC to deploy to npmjs via Trusted Publisher
+  id-token: write   # Required for OIDC
+  contents: read    # Required for checkout
 
 jobs:
   publish:
@@ -13,20 +14,18 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+
+      - name: Setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Build
         run: |
           yarn
           yarn prepare
 
-      - name: Setup node for publishing
-        uses: actions/setup-node@v3
-        with:
-          node-version: '22.x'
-          registry-url: 'https://registry.npmjs.org'
-
       - name: Publish to npm
-        run: |
-          npm ci
-          npm publish
+        run: npm publish