diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4316045f..7ba18303 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -52,22 +52,23 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      id-token: write  # Required for OIDC
+      contents: read
     steps:
       - name: set env
         run: echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
       - uses: actions/checkout@v3
       - uses: actions/download-artifact@v4.1.7
       - run: ls */* | cat
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
-          node-version: '16.x'
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
       - run: npm install
       - name: npm publish
         # skip npm publishing if running in a fork
         if: github.repository == 'amazon-ion/ion-js'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish
   update-docs:
     if: startsWith(github.ref, 'refs/tags/v')