diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 267bb2b..726168c 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -47,7 +47,10 @@ jobs:
         node-version: "20"
         registry-url: "https://registry.npmjs.org"
     - name: Update npm
-      run: npm install -g npm@latest
+      # npm@latest (>=12) requires Node >=22 and breaks on this Node 20 runner
+      # (EBADENGINE). Pin to 11.6.2: the newest line that still supports Node 20
+      # (engines: node ^20.17.0 || >=22) and OIDC trusted publishing (npm >=11.5.1).
+      run: npm install -g npm@11.6.2
     - name: Set package version from tag
       working-directory: npm
       run: npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version --allow-same-version