diff --git a/.changeset/publish-retry-2.md b/.changeset/publish-retry-2.md
new file mode 100644
index 0000000..febffe4
--- /dev/null
+++ b/.changeset/publish-retry-2.md
@@ -0,0 +1,5 @@
+---
+"@wasmagent/agentbom-core": patch
+---
+
+chore: fix release workflow npm authentication
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 694d722..4899b2f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,13 +23,9 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "24"
-          registry-url: https://registry.npmjs.org
+          registry-url: "https://registry.npmjs.org"
       - run: bun install --frozen-lockfile
       - run: bun run build
-      - name: Set npm registry
-        run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       - uses: changesets/action@v1
         with:
           version: bun run release:version
@@ -38,5 +34,5 @@ jobs:
           title: "chore: release packages"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: "true"