diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9a1b4333..8935aaf2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,11 +12,14 @@ env:
 jobs:
   build-deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
     - uses: actions/checkout@v3
     - uses: actions/setup-node@v3
       with:
-        node-version: 16
+        node-version: 18
         registry-url: 'https://registry.npmjs.org'
 
     # - name: Cache dependencies
@@ -101,7 +104,7 @@ jobs:
 
     # - run: npm install @jsdevtools/npm-publish -g
     # - run: npm-publish --token="${{ secrets.NPM_TOKEN }}" ./package.json
-    - run: npm publish --access public
+    - run: npm publish --access public --provenance
       name: 📦  hotkeys-js to NPM
       continue-on-error: true
       env: