diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 55e73466e..4c8888ba2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,8 +23,23 @@ jobs:
           node-version: ${{ steps.nvm.outputs.NVMRC }}
           registry-url: 'https://registry.npmjs.org'
       - name: Upgrade npm for OIDC support
-        run: npm install -g npm@latest
+        # npm 12 requires node >= 22.22.2, newer than our .nvmrc; npm 11.5.1+ has OIDC support
+        run: npm install -g npm@11
       - name: Install dependencies and build 🔧
         run: yarn install --immutable
       - name: Publish package on NPM 📦
         run: npm publish --provenance --access public ${{ github.event.release.prerelease && '--tag next' || ''}}
+  notify-failure:
+    runs-on: ubuntu-latest
+    needs: build
+    if: failure()
+    permissions:
+      issues: write
+    steps:
+      - name: Create issue about publish failure
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh issue create --repo "$GITHUB_REPOSITORY" \
+            --title "npm publish failed for ${{ github.event.release.tag_name }}" \
+            --body "The [Publish to NPM run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for release \`${{ github.event.release.tag_name }}\` failed. The package was not published to npm."