diff --git a/.github/workflows/publish-deploy.yml b/.github/workflows/publish-deploy.yml
index c31dda8c6..2766df3a3 100644
--- a/.github/workflows/publish-deploy.yml
+++ b/.github/workflows/publish-deploy.yml
@@ -8,6 +8,7 @@ jobs:
   publish-npm:
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: read
     steps:
       - uses: actions/checkout@v6
@@ -15,6 +16,7 @@ jobs:
         with:
           node-version-file: .nvmrc
           registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false  # never use caching in release builds
           scope: "@epfml"
       - uses: actions/cache@v5
         with:
@@ -27,9 +29,7 @@ jobs:
         if: github.ref_type == 'branch'
       - run: npm --workspace=discojs{,-node,-web} run build
       - run: npm --workspace=discojs{,-node,-web} publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
+       
   build-webapp:
     if: github.ref_type == 'branch'
     runs-on: ubuntu-latest