diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 86d30e9..51fcd66 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,6 +19,9 @@ jobs:
     environment:
       name: npm
       url: https://www.npmjs.com/package/@dfinity/pic
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -44,7 +47,7 @@ jobs:
 
       - name: Publish to npm
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'
         run: |
           npm pack ./packages/pic/
 
@@ -56,7 +59,7 @@ jobs:
           $release_cmd
 
       - name: Create Github release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
         with:
           artifacts: 'dfinity-pic-${{ github.ref_name }}.tgz'
           bodyFile: 'RELEASE_NOTES.md'