diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index f0968544b..127e26d7e 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -10,10 +10,9 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
     permissions:
       contents: write
-      id-token: write
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -29,6 +28,9 @@ jobs:
           prerelease: false
 
   publish:
+    permissions:
+      contents: write
+      id-token: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -41,3 +43,4 @@ jobs:
           yarn release:publish${{ contains(github.ref_name, 'alpha') && ':alpha' || contains(github.ref_name, 'beta') && ':beta' || '' }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
diff --git a/.npmrc b/.npmrc
deleted file mode 100644
index 268c392d3..000000000
--- a/.npmrc
+++ /dev/null
@@ -1 +0,0 @@
-provenance=true