diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 3912938b..79067105 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -3,22 +3,39 @@ name: Publish to npm
 on:
   release:
     types: [created]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to publish (e.g. v0.1.1)"
+        required: true
+        type: string
+
+permissions:
+  id-token: write # npm trusted publishing (OIDC) — no registry token
+  contents: read
 
 jobs:
   build:
+    name: Build and publish (trusted publishing)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
       - name: Update version in package.json
         run: |
-          VERSION=$(echo "${{ github.event.release.tag_name }}" | sed 's/^v//')
+          VERSION=$(echo "${{ inputs.tag || github.event.release.tag_name }}" | sed 's/^v//')
           sed -i "s/\"version\": \"{{version}}\"/\"version\": \"$VERSION\"/g" package.json
-      - uses: actions/setup-node@v3
+
+      - uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          node-version: '24.x' # npm 11.5.1+ required for trusted publishing
           registry-url: 'https://registry.npmjs.org'
+
       - run: npm install
       - run: npm test
+      # No NODE_AUTH_TOKEN: auth comes from the GitHub OIDC token via the
+      # trusted publisher registered for this package on npmjs.com
+      # (AACTools/WorldAlphabets, workflow npm-publish.yml).
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}