diff --git a/.changeset/friendly-socks-agree.md b/.changeset/friendly-socks-agree.md
new file mode 100644
index 00000000..36590d39
--- /dev/null
+++ b/.changeset/friendly-socks-agree.md
@@ -0,0 +1,5 @@
+---
+"starlight-spell-checker": patch
+---
+
+Setups trusted publishing using OpenID Connect (OIDC) authentication — no code changes.
diff --git a/.github/workflows/format.yaml b/.github/workflows/format.yaml
index ecc2f943..61c5e602 100644
--- a/.github/workflows/format.yaml
+++ b/.github/workflows/format.yaml
@@ -6,6 +6,9 @@ on:
 permissions:
   contents: read
 
+env:
+  NODE_VERSION: 24.10.0
+
 jobs:
   autofix:
     runs-on: ubuntu-latest
@@ -18,7 +21,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20.19.5
+          node-version: ${{ env.NODE_VERSION }}
           cache: "pnpm"
 
       - name: Install Dependencies
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 11977a43..ae53b217 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -11,10 +11,8 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  REGISTRY: docker.io
-  IMAGE_OWNER: trueberryless
   IMAGE_NAME: starlight-spell-checker
-  NODE_VERSION: 20
+  NODE_VERSION: 24.10.0
 
 jobs:
   changes:
@@ -102,12 +100,12 @@ jobs:
     needs: [changes, changesets, image-tag]
     if: >
       (
-        needs.changesets.outputs.hasChangesets == 'false' && 
+        needs.changesets.outputs.hasChangesets == 'false' &&
         (
-          contains(github.event.head_commit.message, 'deploy') || 
+          contains(github.event.head_commit.message, 'deploy') ||
           contains(github.event.head_commit.message, 'release')
         )
-      ) || 
+      ) ||
       github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
@@ -131,7 +129,7 @@ jobs:
 
       - run: |
           cd packages/starlight-spell-checker
-          npm publish --provenance --access public
+          npm publish --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}