diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7047e201..ea64e5b4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -96,8 +96,6 @@ jobs:
       - name: Publish to npm
         run: npm publish --provenance
         working-directory: packages/portless
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   github-release:
     name: Create GitHub Release
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 96f88b08..aa3bb6d6 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -10,9 +10,14 @@ Pushing a new version to `main` is what publishes. There is no separate approval
 
 ## One-time setup
 
-- Create an npm granular access token with publish rights on the `@variablelab` scope and "bypass two-factor authentication" enabled (npm requires this for publishes from CI). Add it to the repository as the `NPM_TOKEN` secret under Settings, Secrets and variables, Actions.
-- The publish job runs in the `Release` GitHub environment. GitHub creates it on the first run. Add required reviewers to that environment if you want a manual gate before every publish.
-- Alternative: configure [npm trusted publishing](https://docs.npmjs.com/trusted-publishers) for `variableland/portless` with the `release.yml` workflow, then delete the `NODE_AUTH_TOKEN` line from the publish step. Provenance works with either method.
+- Publishing uses [npm trusted publishing](https://docs.npmjs.com/trusted-publishers): the `@variablelab/portless` package on npm trusts the `release.yml` workflow of `variableland/portless` running in the `Release` environment, and the job exchanges its GitHub OIDC token for a short-lived npm token. No long-lived token is stored. To re-create the relationship (interactive 2FA):
+
+  ```bash
+  npm trust github @variablelab/portless --file release.yml --repo variableland/portless --env Release --allow-publish
+  ```
+
+- The `Release` GitHub environment exists. Add required reviewers there if you want a manual gate before every publish.
+- The `NPM_TOKEN` secret used for the first release (0.0.1) is no longer read by the workflow. Revoke it on npmjs.com and delete the secret after the first successful OIDC publish.
 
 ## Cut a release
 
diff --git a/packages/portless/package.json b/packages/portless/package.json
index 213681ba..3f873535 100644
--- a/packages/portless/package.json
+++ b/packages/portless/package.json
@@ -55,9 +55,9 @@
   "author": "Vercel Labs",
   "contributors": [
     {
-      "name": "Ricardo (rcrd)",
+      "name": "Ricardo Q. Bazan",
       "email": "ricardo@variable.land",
-      "url": "https://github.com/variableland/portless"
+      "url": "https://github.com/rqbazan"
     }
   ],
   "license": "Apache-2.0",