diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index e912591..6e8b9a6 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -9,6 +9,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: write
+  id-token: write
+
 jobs:
   test:
     name: Test
@@ -16,17 +20,17 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Use pnpm 9.x
         uses: pnpm/action-setup@v4
         with:
           version: 9.x
 
-      - name: Use Node.js 18.x
-        uses: actions/setup-node@v3
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 18.x
+          node-version: 22.x
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
@@ -38,21 +42,21 @@ jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
-    needs: test # This ensures tests must pass before publishing
+    needs: test
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Use pnpm 9.x
         uses: pnpm/action-setup@v4
         with:
           version: 9.x
 
-      - name: Use Node.js 18.x
-        uses: actions/setup-node@v3
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 18.x
+          node-version: 22.x
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
@@ -74,5 +78,3 @@ jobs:
         # Build happens on "prepare" (before publish)
       - name: Publish to npm
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2ca9ec7..b0659b3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,17 +16,17 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Use pnpm 9.x
         uses: pnpm/action-setup@v4
         with:
           version: 9.x
 
-      - name: Use Node.js 18.x
-        uses: actions/setup-node@v3
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 18.x
+          node-version: 22.x
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies