diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c39000f..3b1949a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,6 +55,29 @@ jobs:
         with:
           subject-checksums: ./dist/digests.txt
 
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: 24 # npm >= 11.5.1 required for OIDC trusted publishing
+      # TODO: switch to goreleaser-npm-publisher-action once https://github.com/evg4b/goreleaser-npm-publisher/pull/26 is released
+      # Prebuilt dist committed on the fork branch (5e09f1e + dist/, built and
+      # smoke-tested locally). Deliberately no yarn install/build here: this job
+      # holds id-token: write, so third-party install scripts must not run in it.
+      - name: Fetch goreleaser-npm-publisher
+        run: |
+          git clone https://github.com/khvn26/goreleaser-npm-publisher "$RUNNER_TEMP/gnp"
+          git -C "$RUNNER_TEMP/gnp" checkout ad16d393106b23b6289d0569beefb8e9b3bd3159
+      - name: Publish npm packages
+        run: >-
+          node "$RUNNER_TEMP/gnp/dist/cli.cjs" publish
+          --name cli
+          --bin flagsmith
+          --prefix @flagsmith
+          --license MIT
+          --repository 'git+https://github.com/Flagsmith/flagsmith-cli.git'
+          --description 'The Flagsmith command-line interface'
+          --keywords flagsmith feature-flags cli
+          --files README.md LICENSE
+
       # During public beta the newest beta is what people
       # should land on, so clear it.
       - if: contains(github.ref_name, '-beta')