diff --git a/.github/workflows/publish-cm5.yml b/.github/workflows/publish-cm5.yml
index 1a01e64..91dc547 100644
--- a/.github/workflows/publish-cm5.yml
+++ b/.github/workflows/publish-cm5.yml
@@ -4,6 +4,8 @@ on:
 
 permissions:
   contents: read
+  # Required for npm trusted publishing (OIDC).
+  id-token: write
 
 jobs:
   publish:
@@ -19,7 +21,6 @@ jobs:
           node-version: 22
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
-          registry-url: https://registry.npmjs.org
 
       - run: pnpm install --frozen-lockfile
 
@@ -27,9 +28,9 @@ jobs:
       # vim_test.js) are generated by its build.
       - run: pnpm --filter cm5-vim run build
 
+      # Auth is npm trusted publishing (OIDC) — cm5-vim must have this repo +
+      # workflow configured as a trusted publisher on npmjs.com.
       - name: Publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.CM5_NPM_TOKEN }}
         run: |
           version=$(node -p "require('./packages/cm5-vim/package.json').version")
           if [ "$(npm view "cm5-vim@$version" version 2>/dev/null)" = "$version" ]; then
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4f07d07..7c7d04f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,11 +4,16 @@ on:
 
 permissions:
   contents: read
+  # Required for npm trusted publishing (OIDC).
+  id-token: write
 
 jobs:
   publish:
     name: Publish @replit/codemirror-vim-core and @replit/codemirror-vim
     runs-on: ubuntu-latest
+    # Must match the environment configured in the npm trusted publisher
+    # settings for both packages.
+    environment: cm6 publish
     steps:
       - uses: actions/checkout@v4
 
@@ -19,15 +24,14 @@ jobs:
           node-version: 22
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
-          registry-url: https://registry.npmjs.org
 
       - run: pnpm install --frozen-lockfile
 
       # Core is published first: @replit/codemirror-vim depends on it, so the
       # version its workspace:^ range resolves to must exist on the registry.
+      # Auth is npm trusted publishing (OIDC) — both packages must have this
+      # repo + workflow configured as a trusted publisher on npmjs.com.
       - name: Publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           for dir in packages/codemirror-vim-core packages/codemirror-vim; do
             name=$(node -p "require('./$dir/package.json').name")