diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1c5fa972..6f2c6fab 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -35,6 +35,11 @@ jobs:
                   cache: "pnpm"
                   registry-url: "https://registry.npmjs.org"
 
+            # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 22 bundles npm 10.
+            # pnpm publish shells out to this npm for the upload.
+            - name: Upgrade npm
+              run: npm install -g npm@11
+
             - name: Cache tree-sitter CLI
               id: cache-tree-sitter
               uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4