diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 89fdb23..3b710a7 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -9,13 +9,14 @@ jobs:
       contents: read
       id-token: write  # required to use OIDC
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm ci
-      - run: npm run build
-      - uses: JS-DevTools/npm-publish@v4
-        with:
-          registry: "https://registry.npmjs.org/"
+          registry-url: "https://registry.npmjs.org"
+          cache: "pnpm"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
+      - run: pnpm publish --provenance
+