diff --git a/.github/workflows/tools-cli-release.yml b/.github/workflows/tools-cli-release.yml
index 1939b03..d975201 100644
--- a/.github/workflows/tools-cli-release.yml
+++ b/.github/workflows/tools-cli-release.yml
@@ -3,6 +3,11 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
@@ -20,22 +25,19 @@ jobs:
         with:
           node-version: 20
           registry-url: https://registry.npmjs.org/
-      - run: cd tools && npm publish
+      - run: cd tools && npm publish --provenance --access public
         env:
           NODE_AUTH_TOKEN: ${{ steps.dotenvx.outputs.NPM_AUTH_TOKEN }}
           NPM_AUTH_TOKEN: ${{ steps.dotenvx.outputs.NPM_AUTH_TOKEN }}
   publish-ghp:
       runs-on: ubuntu-latest
       needs: [publish-npm]
-      permissions:
-        contents: read
-        packages: write
       steps:
         - uses: actions/checkout@v4
         - uses: actions/setup-node@v3
           with:
             node-version: 20
             registry-url: https://npm.pkg.github.com
-        - run: cd tools && npm publish
+        - run: cd tools && npm publish --provenance
           env:
             NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
\ No newline at end of file