diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 29d5b5b..475d906 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,11 @@ jobs:
   # repo + this workflow file registered as a Trusted Publisher on
   # npmjs.com. npm only allows that on an EXISTING package, so the first
   # publish of each name is a manual `pnpm release` by a maintainer.
+  #
+  # The OIDC exchange lives in the npm CLI itself and needs npm >= 11.5.1;
+  # with an older npm the PUT goes out unauthenticated and the registry
+  # answers E404. Node 22 bundles npm 10, hence Node 24 plus an explicit
+  # upgrade rather than trusting whatever the runner image bundles.
   release:
     needs: test
     runs-on: ubuntu-latest
@@ -43,9 +48,11 @@ jobs:
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
           registry-url: https://registry.npmjs.org
+      - name: npm with trusted publishing support
+        run: npm install -g npm@latest && npm --version
       - run: pnpm install --frozen-lockfile
       - name: Create Release Pull Request or Publish to npm
         uses: changesets/action@v1