diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0db1c39..beb0a47 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # npm trusted publishing: npm exchanges this OIDC token for a publish token.
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -28,22 +30,26 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           registry-url: https://registry.npmjs.org
 
+      # Trusted publishing needs npm >= 11.5.1.
+      - run: npm install -g npm@^11.5.1
+
       - run: pnpm install --frozen-lockfile
 
+      # Bump in the working tree only; it is committed after a successful publish
+      # so a failed run never leaves an unpublished version on main. Bumping from
+      # the higher of npm's latest and package.json keeps a rerun from re-publishing
+      # a version whose bump commit never reached main.
       - name: Bump patch version
+        id: bump
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          # Re-base onto the latest main first so a re-run or a race never hits a
-          # non-fast-forward push (the old failure mode).
-          git pull --rebase origin main
-          VERSION=$(npm version patch --no-git-tag-version)
-          git add package.json
-          git commit -m "chore: bump version to ${VERSION} [skip ci]"
-          git push origin HEAD:main
+          PUBLISHED=$(npm view @recoupable/cli version)
+          LOCAL=$(node -p "require('./package.json').version")
+          BASE=$(printf '%s\n%s\n' "$PUBLISHED" "$LOCAL" | sort -V | tail -1)
+          npm version "$BASE" --no-git-tag-version --allow-same-version
+          echo "version=$(npm version patch --no-git-tag-version)" >> "$GITHUB_OUTPUT"
 
       - run: pnpm exec tsc --noEmit
 
@@ -52,6 +58,13 @@ jobs:
       - run: pnpm test
 
       - name: Publish to npm
-        run: pnpm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish
+
+      - name: Commit version bump
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add package.json
+          git commit -m "chore: bump version to ${{ steps.bump.outputs.version }} [skip ci]"
+          git pull --rebase origin main
+          git push origin HEAD:main
diff --git a/package.json b/package.json
index e812f7d..58fb609 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,10 @@
   "name": "@recoupable/cli",
   "version": "0.1.18",
   "description": "Recoup platform CLI",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/recoupable/cli.git"
+  },
   "type": "module",
   "bin": {
     "recoup": "./dist/bin.cjs"