diff --git a/.changeset/config.json b/.changeset/config.json
index 5c58ec9..ec98e35 100644
--- a/.changeset/config.json
+++ b/.changeset/config.json
@@ -4,7 +4,7 @@
   "commit": false,
   "fixed": [],
   "linked": [],
-  "access": "restricted",
+  "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
   "ignore": []
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75fce10..7520304 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,16 +7,19 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
-permissions:
-  id-token: write # Required for OIDC
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   release:
     if: github.repository == 'webpack/coffee-loader'
     name: Release
     runs-on: ubuntu-latest
+    # Must match the environment set on the npm trusted publisher for this package.
+    environment: npm
+    permissions:
+      id-token: write # mint the OIDC token npm exchanges for a short-lived publish token
+      contents: write # version commit, tags and GitHub releases
+      pull-requests: write # open/update the release pull request
     outputs:
       published: ${{ steps.changesets.outputs.published }}
       publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
@@ -28,6 +31,12 @@ jobs:
         with:
           node-version: lts/*
           cache: npm
+          registry-url: "https://registry.npmjs.org"
+
+      # OIDC token exchange needs npm >= 11.5.1 and `npm stage publish` needs
+      # npm >= 11.7.0, which is newer than the npm bundled with some Node LTS lines.
+      - name: Update npm
+        run: npm install -g npm@latest
 
       - run: npm ci
 
@@ -37,7 +46,10 @@ jobs:
         id: changesets
         uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
+          publish: npx changeset publish
           commit: "chore(release): new release"
           title: "chore(release): new release"
+        # No NPM_TOKEN: authentication goes through the npm trusted publisher
+        # configured for this repository and workflow file.
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}