diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index aa59ccb..019ad34 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -118,20 +118,20 @@ jobs:
       - run: npm test
       - run: npm run build
 
+      # Trusted publishing (OIDC): npm swaps this job's id-token for a short-lived
+      # publish credential, so there is no NPM_TOKEN to expire (the 90-day
+      # granular token silently expiring is what broke beta.34). Configured on
+      # npmjs.com → @instawp/cli → Settings → Trusted Publisher (InstaWP/cli,
+      # publish.yml). Needs npm >= 11.5.1; Node 22 bundles npm 10.
+      - run: npm install -g npm@^11.5.1
+
       - name: Publish to npm
-        run: npm publish --access public --tag beta
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Point `latest` at this release
-        # Pre-1.0 there's no separate stable channel, so `latest` — what a plain
-        # `npm i -g @instawp/cli` installs — must track the newest beta.
-        # Publishing with `--tag beta` does NOT move `latest`, which is how it
-        # got stranded on an ancient version. Keep them in sync until a stable
-        # 1.x exists (then publish stable to `latest` and drop this step).
-        run: npm dist-tag add "@instawp/cli@${GITHUB_REF_NAME#v}" latest
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        # Straight to `latest` — what `npm i -g @instawp/cli`, `instawp upgrade`
+        # and the update notifier read. Pre-1.0 there is no separate stable
+        # channel. OIDC covers `npm publish` only (not `npm dist-tag`), so we
+        # publish to the tag we want rather than moving it afterwards. npm 11
+        # refuses to publish a prerelease without an explicit --tag.
+        run: npm publish --access public --tag latest
 
       - name: Create GitHub Release from CHANGELOG
         env:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5d90d37..a022dad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 # Changelog
 
-## Unreleased
+## 0.0.1-beta.35 (2026-10-12)
+
+**First npm release since 0.0.1-beta.33.** The 0.0.1-beta.34 tag exists on GitHub but never reached npm (its publish was rejected — see below), so this release also ships everything listed under 0.0.1-beta.34: the Windows / Node 24+ install fix.
+
+### Changed — releases publish via npm trusted publishing
+
+- The release workflow now authenticates to npm with GitHub's OIDC identity instead of a stored `NPM_TOKEN`. That token had silently expired, which is why 0.0.1-beta.34 failed to publish with `E404`. Nothing to expire now; published versions also carry npm provenance.
+- Releases go straight to the `latest` dist-tag (what `npm i -g @instawp/cli` and `instawp upgrade` install). The `beta` dist-tag is no longer updated and stays at 0.0.1-beta.33.
 
 ### Fixed — `local stop` left the server running when Playground ran via npx
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 30e3660..897467d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -307,7 +307,7 @@ instawp --help
 git tag -a v0.0.1-beta.2 -m "..." && git push origin v0.0.1-beta.2
 ```
 
-- Publishes with `--tag beta` (install via `npm i -g @instawp/cli@beta`). `latest` stays on an old stable; drop `--tag beta` for stable releases. Uses `NPM_TOKEN`.
+- Publishes to the `latest` dist-tag via **npm trusted publishing (OIDC)** — no `NPM_TOKEN`. The trusted publisher is configured on npmjs.com (`@instawp/cli` → Settings → Trusted Publisher: GitHub Actions, `InstaWP/cli`, `publish.yml`); renaming the workflow file breaks publishing until that is updated. OIDC cannot run `npm dist-tag`, so the `beta` dist-tag is frozen at 0.0.1-beta.33 (nothing reads it). A publish `E404 PUT` means npm rejected the credential, not a missing package.
 - **`publish.yml`** (tag-triggered): Windows smoke test → build → test → npm publish → GitHub Release. **`release-notify.yml`** (also tag-triggered, unlike siblings which fire on PR-merge) → Claude summary to Slack. Both extract the CHANGELOG section by **exact** `## <version> ` header match, so the version in `package.json`, the tag, and the CHANGELOG header must all agree.
 - Pushing the tag is the release trigger; pushing `main` alone publishes nothing. Tag dispatch / secret listing needs repo admin (a normal token gets 403).
 
diff --git a/package-lock.json b/package-lock.json
index 91b65eb..071dcbe 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@instawp/cli",
-  "version": "0.0.1-beta.34",
+  "version": "0.0.1-beta.35",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@instawp/cli",
-      "version": "0.0.1-beta.34",
+      "version": "0.0.1-beta.35",
       "license": "MIT",
       "dependencies": {
         "archiver": "^7.0.1",
diff --git a/package.json b/package.json
index 5cfa70d..3cc76c2 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@instawp/cli",
-  "version": "0.0.1-beta.34",
+  "version": "0.0.1-beta.35",
   "description": "InstaWP CLI - Create and manage WordPress sites from the terminal",
   "type": "module",
   "bin": {