diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 82fb44d..ed831ec 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -2,10 +2,6 @@ name: CI
 
 on:
   pull_request:
-    branches:
-      - main
-      - next
-  push:
     branches:
       - main
   workflow_dispatch:
@@ -19,7 +15,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@v5
         with:
-          node-version: '22'
+          node-version: "22"
       - run: npm ci
       - run: npm run test
       - run: npm run build
@@ -36,7 +32,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@v5
         with:
-          node-version: '22'
+          node-version: "22"
       - run: npm ci
       - run: npm run build
       - run: npm run test:integration
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 686413d..a7c9a65 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -35,6 +35,12 @@ jobs:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
 
+      # OIDC trusted publishing on `npm publish` needs npm >= 11.5.1; node 22
+      # bundles npm ~10.9, which can sign provenance but cannot authenticate
+      # the publish via OIDC (semantic-release did its own OIDC exchange).
+      # Pin to major 11 (latest 11.x) rather than @latest for reproducibility.
+      - run: npm install -g npm@11
+
       - run: npm ci
       - run: npm run lint
       - run: npm run build
@@ -206,6 +212,12 @@ jobs:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
 
+      # OIDC trusted publishing on `npm publish` needs npm >= 11.5.1; node 22
+      # bundles npm ~10.9, which can sign provenance but cannot authenticate
+      # the publish via OIDC (semantic-release did its own OIDC exchange).
+      # Pin to major 11 (latest 11.x) rather than @latest for reproducibility.
+      - run: npm install -g npm@11
+
       - run: npm ci
       - run: npm run build