diff --git a/.github/workflows/force-release.yml b/.github/workflows/force-release.yml
index fc62c4c..99f171f 100644
--- a/.github/workflows/force-release.yml
+++ b/.github/workflows/force-release.yml
@@ -32,4 +32,7 @@ jobs:
         run: yarn run publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # OIDC trusted publishing was never configured on npmjs.com (this
+          # workflow has failed on every dispatch since Feb 2026). Token fallback:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1da8397..991a95b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -51,4 +51,8 @@ jobs:
         run: yarn run publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # OIDC trusted publishing was never configured on npmjs.com, so every
+          # tokenless publish fails E404-on-PUT (provenance signs, PUT rejects).
+          # NODE_AUTH_TOKEN feeds the .npmrc written by setup-node's registry-url.
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
\ No newline at end of file