diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ae3c5a2..5715921 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,6 +10,9 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     env:
       NODE_OPTIONS: --max-old-space-size=4096
     outputs:
diff --git a/package.json b/package.json
index d35a713..6af6094 100644
--- a/package.json
+++ b/package.json
@@ -70,7 +70,8 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org/"
+    "registry": "https://registry.npmjs.org/",
+    "provenance": true
   },
   "husky": {
     "hooks": {