diff --git a/.github/workflows/publish-package-to-npm.yml b/.github/workflows/publish-package-to-npm.yml
index 40698451..fdf5cd16 100644
--- a/.github/workflows/publish-package-to-npm.yml
+++ b/.github/workflows/publish-package-to-npm.yml
@@ -172,6 +172,10 @@ jobs:
   build-and-test-and-publish:
     runs-on: ubuntu-latest
     needs: [validate-packages-as-releasable, prepare-release-branch]
+    permissions:
+      # Required for npm Trusted Publishing (OIDC).
+      id-token: write
+      contents: read
     steps:
       - name: Support long paths
         run: git config --global core.longpaths true
@@ -180,7 +184,21 @@ jobs:
           ref: ${{ needs.prepare-release-branch.outputs.branch-name }}
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          # Trusted Publishing requires Node >= 22.14.0.
+          node-version: 22
+      # Trusted Publishing requires npm >= 11.5.1, and managing dist-tags via OIDC requires npm >= 11.21.0.
+      # Pinned to the npm 11 line to stay consistent with the code-analyzer repo (npm 12 removed shrinkwrap support).
+      - name: Upgrade npm for Trusted Publishing
+        run: |
+          npm install -g npm@11
+          # Print the resolved version, and fail fast if the moving 'npm@11' tag ever resolves below what
+          # dist-tag management via OIDC needs, rather than failing later in the middle of a release.
+          NPM_VERSION="$(npm --version)"
+          echo "Using npm ${NPM_VERSION}"
+          if [ "$(printf '%s\n' "11.21.0" "${NPM_VERSION}" | sort -V | head -n1)" != "11.21.0" ]; then
+            echo "::error::npm ${NPM_VERSION} is older than the required 11.21.0"
+            exit 1
+          fi
       - name: Build and test and publish packages
         run: |
           PACKAGES_TO_PUBLISH=(${{ needs.validate-packages-as-releasable.outputs.packages-to-release }})
@@ -191,8 +209,8 @@ jobs:
             npm install
             npm run build
             npm run test
-            # We need the NPM token to publish.
-            echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
+            # No NPM token is needed. npm authenticates via Trusted Publishing (OIDC). Each package must have this
+            # workflow configured as a trusted publisher on npmjs.com, with "Allow npm dist-tag" enabled.
             PUBLISHED_VERSION=$(jq -r ".version" package.json)
             if [[ "${{ inputs.dryrun }}" == "true" ]]; then
               npm publish --tag latest-beta --access public --verbose --dry-run