diff --git a/.changeset/nine-jobs-sneeze.md b/.changeset/nine-jobs-sneeze.md
new file mode 100644
index 00000000..febff80a
--- /dev/null
+++ b/.changeset/nine-jobs-sneeze.md
@@ -0,0 +1,6 @@
+---
+'homebridge-ring': patch
+'ring-client-api': patch
+---
+
+Use `provenance` when publishing to npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2cc04aaa..c5d9f7b7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,10 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+  id-token: write # needed for provenance
+
 jobs:
   release:
     name: Release
@@ -25,7 +29,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 18.x
+          node-version: 22.x
           cache: 'npm'
 
       - name: Install Dependencies
@@ -38,3 +42,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN_CHANGESETS }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true