diff --git a/.github/workflows/publish_artifacts.yaml b/.github/workflows/publish_artifacts.yaml
index 4329d28cc81..dcb68f85594 100644
--- a/.github/workflows/publish_artifacts.yaml
+++ b/.github/workflows/publish_artifacts.yaml
@@ -38,7 +38,7 @@ jobs:
       - name: Read Node.js version
         id: node-version
         run: echo "version=$(cat client/.node_version)" >> $GITHUB_OUTPUT
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ steps.node-version.outputs.version }}
           cache: 'yarn'
@@ -47,6 +47,9 @@ jobs:
       - name: build client
         run: yarn && yarn build-production
         working-directory: 'client'
+      # Ensure npm 11.5.1 or later for trusted publishing
+      - run: npm install -g npm@latest
+        working-directory: 'client'
       - name: publish client
         if: "!github.event.release.prerelease"
         run: npm publish --provenance --access public