diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 09a3579..445811b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -103,6 +103,7 @@ jobs:
     name: Publish release
     permissions:
       contents: write
+      id-token: write
     uses: ./.github/workflows/publish-release.yml
     secrets:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index e77c39a..ecc333b 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -4,7 +4,7 @@ on:
   workflow_call:
     secrets:
       NPM_TOKEN:
-        required: true
+        required: false
       SLACK_WEBHOOK_URL:
         required: true
 
@@ -47,7 +47,7 @@ jobs:
         with:
           name: publish-release-artifacts-${{ github.sha }}
       - name: Dry Run Publish
-        uses: MetaMask/action-npm-publish@v5
+        uses: MetaMask/action-npm-publish@18df42148c35aabb98e00f9fda127d421af141df # v6
         with:
           slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
           subteam: S042S7RE4AE
@@ -58,6 +58,9 @@ jobs:
     needs: publish-npm-dry-run
     runs-on: ubuntu-latest
     environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout and setup environment
         uses: MetaMask/action-checkout-and-setup@v2
@@ -69,8 +72,12 @@ jobs:
         with:
           name: publish-release-artifacts-${{ github.sha }}
       - name: Publish
-        uses: MetaMask/action-npm-publish@v5
+        uses: MetaMask/action-npm-publish@18df42148c35aabb98e00f9fda127d421af141df # v6
         with:
+          # This `NPM_TOKEN` is only needed to publish a package for the first
+          # time. Look in the repository settings under "Environments", and set
+          # this token in the `npm-publish` environment, then delete it after
+          # the initial OIDC publish.
           npm-token: ${{ secrets.NPM_TOKEN }}
         env:
           SKIP_PREPACK: true
diff --git a/package.json b/package.json
index 0a45d3d..bbb5c82 100644
--- a/package.json
+++ b/package.json
@@ -105,7 +105,7 @@
     "@playwright/test": "^1.49.0",
     "playwright": "^1.49.0"
   },
-  "packageManager": "yarn@4.11.0",
+  "packageManager": "yarn@4.16.0",
   "engines": {
     "node": "^20 || ^22 || >=24"
   },
diff --git a/yarn.lock b/yarn.lock
index a00c793..45d4056 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2,7 +2,7 @@
 # Manual changes might be lost - proceed with caution!
 
 __metadata:
-  version: 8
+  version: 10
   cacheKey: 10
 
 "@andrewbranch/untar.js@npm:^1.0.3":