diff --git a/.github/workflows/publish-to-npm.yaml b/.github/workflows/publish-to-npm.yaml
index f7f0373e..4e1278bf 100644
--- a/.github/workflows/publish-to-npm.yaml
+++ b/.github/workflows/publish-to-npm.yaml
@@ -4,10 +4,19 @@ on:
   push:
     branches: [ main ]
 
+# Never run two publishes at once; a second merge waits for the first to finish
+concurrency:
+  group: publish-to-npm
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
-    if: "!contains(github.event.head_commit.author.email, 'hello@openactive.io')"
+    # Loop guard: the version bump commit below is pushed by the OpenActive GitHub App, and also carries [skip ci]
+    if: ${{ github.actor != 'openactive[bot]' }}
 
     steps:
     - name: Generate GitHub App Token
@@ -24,20 +33,21 @@ jobs:
       run: |
         git config --global user.name "openactive[bot]"
         git config --global user.email 207210293+openactive[bot]@users.noreply.github.com
-    - name: Use Node.js 14.x
-      uses: actions/setup-node@v1
+    - name: Use Node.js 18.17.1
+      uses: actions/setup-node@v4
       with:
-        node-version: 14
+        node-version: 18.17.1
         registry-url: https://registry.npmjs.org/
     - name: Install
       run: npm ci
     - name: Test
       run: npm test
     - name: Increment Version
-      run: npm version patch
+      run: npm version patch -m "%s [skip ci]"
+    # Push before publishing: if the push is rejected, nothing is published, so npm can never get ahead of GitHub
+    - name: Push version update
+      run: git push origin HEAD:main
     - name: Publish to npm
       run: npm publish
       env:
-        NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-    - name: Push version update
-      run: git push
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN2 }}
diff --git a/package-lock.json b/package-lock.json
index 2fb97eac..0e000ab5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "@openactive/models-ts",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
diff --git a/package.json b/package.json
index a17b5ff9..f18fc575 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@openactive/models-ts",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "JavaScript/TypeScript implementation of OpenActive's data model",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",