diff --git a/.changeset/add-release-environment.md b/.changeset/add-release-environment.md
new file mode 100644
index 0000000..96fd689
--- /dev/null
+++ b/.changeset/add-release-environment.md
@@ -0,0 +1,5 @@
+---
+"@deessejs/errors": patch
+---
+
+Tag the release job with `environment: release` so the run is recorded as a deployment to the `release` GitHub environment. Future hardening (required reviewers, branch restrictions, wait timer) can attach to the same environment without further workflow changes. Provenance and trusted publishing are unaffected.
diff --git a/.changeset/switch-to-trusted-publishing.md b/.changeset/switch-to-trusted-publishing.md
new file mode 100644
index 0000000..ab285dd
--- /dev/null
+++ b/.changeset/switch-to-trusted-publishing.md
@@ -0,0 +1,5 @@
+---
+"@deessejs/errors": patch
+---
+
+Switch the release workflow to npm trusted publishing (OIDC) instead of `secrets.NPM_TOKEN`. The `id-token: write` permission, already declared on the job, is sufficient for GitHub to mint the OIDC token that npm exchanges for a short-lived publish credential. Provenance is generated automatically on public repos. The `NPM_TOKEN` secret can be revoked once the first OIDC publish succeeds.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3bc4dc3..4ebd652 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,6 +26,7 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    environment: release
     # Run when a PR is merged into main OR manually triggered
     if: |
       github.event_name == 'workflow_dispatch' ||
@@ -84,8 +85,6 @@ jobs:
 
       - name: Publish packages
         if: steps.detect.outputs.has_changesets == 'true' && (github.event_name == 'workflow_dispatch' || inputs.dry_run != true)
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           if [ -n "${{ inputs.packages }}" ]; then
             pnpm changeset publish --packages=$(echo "${{ inputs.packages }}" | tr ',' ' ')