diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 19e83e5..2d42d71 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,24 +30,16 @@ jobs:
 
   deploy-npm-release:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC trusted publishing
+      contents: read
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: '14'
+          node-version: '24'
           registry-url: "https://registry.npmjs.org"
-      - name: Get yarn cache directory path
-        id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
-      - uses: actions/cache@v5
-        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-        with:
-          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
+          package-manager-cache: false  # never use caching in release builds
       - run: yarn install
       - run: yarn build
-      - run: yarn publish --non-interactive
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }}
+      - run: npm publish