diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7eb5ecc..95ec4025 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+
 jobs:
   build:
     name: Build ${{ matrix.build-group }}
@@ -75,7 +78,7 @@ jobs:
       with:
         node-version: '20'
         registry-url: 'https://registry.npmjs.org'
-    - run: npm publish --access public
+    - run: npm publish --provenance --access public
       env:
         NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}