diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9e607e0..b2b0437 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,12 +3,16 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
+permissions:
+  id-token: write   # Required for npm trusted publishing (OIDC)
+  contents: write   # Required for autorel to push release tag (and changelog)
 jobs:
   release:
+    name: Release
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
+    concurrency:
+      group: deploy-${{ github.ref }}
+      cancel-in-progress: false
     steps:
       - uses: actions/checkout@v4
         with:
@@ -16,10 +20,11 @@ jobs:
           fetch-tags: true
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
+          node-version: '24'   # npm 11+ required for trusted publishing (OIDC)
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
       - run: npm ci
-      - run: npm run build
-      - run: npx autorel@^2 --publish-args="--provenance"
+      - run: npm run validate
+      - run: npx autorel@^2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}