diff --git a/.github/workflows/auto-publish.yml b/.github/workflows/auto-publish.yml
index ac68b6fa..95fe9bc7 100644
--- a/.github/workflows/auto-publish.yml
+++ b/.github/workflows/auto-publish.yml
@@ -53,7 +53,15 @@ jobs:
   publish:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Setup Node for trusted publishing
+        uses: actions/setup-node@v4
+        with:
+          node-version: '>=24.19.0 <25' # OIDC 需要 Node >=22.14.0 和 npm >=11.5.1；Node 24.5.0 起内置 npm >=11.5.1
+
       - name: Download build artifact
         uses: actions/download-artifact@v4
         with:
@@ -79,12 +87,9 @@ jobs:
           echo "publish tag: ${{ steps.parse_tag.outputs.dist_tag }}"
       - name: Publish @opentiny/fluent-editor
         run: |
-          echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
           cd packages/fluent-editor/dist
           ls
           npm publish --tag ${{ steps.parse_tag.outputs.dist_tag }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Release
         if: ${{ steps.parse_tag.outputs.dist_tag == 'latest' }}
diff --git a/.github/workflows/dispatch-publish.yml b/.github/workflows/dispatch-publish.yml
index b1221a7d..b4035522 100644
--- a/.github/workflows/dispatch-publish.yml
+++ b/.github/workflows/dispatch-publish.yml
@@ -97,7 +97,15 @@ jobs:
   publish:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Setup Node for trusted publishing
+        uses: actions/setup-node@v4
+        with:
+          node-version: '>=24.19.0 <25' # OIDC 需要 Node >=22.14.0 和 npm >=11.5.1；Node 24.5.0 起内置 npm >=11.5.1
+
       - name: Download build artifact
         uses: actions/download-artifact@v4
         with:
@@ -111,11 +119,8 @@ jobs:
       # 步骤8: 发布组件到NPM
       - name: Publish @opentiny/fluent-editor
         run: |
-          echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
           echo "ls"
           ls
           cd packages/fluent-editor/dist
           ls
           npm publish --tag ${{ inputs.tag }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}