diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ee8050..e6ea1b3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ on:
 env:
   SQLX_OFFLINE: true
 
+permissions:
+  id-token: write # Required for OIDC
+
 jobs:
   # ---------------------------------------------------------------------------
   # Path detection — determines which job groups should run.
diff --git a/packages/lex-agent/.releaserc.json b/packages/lex-agent/.releaserc.json
index f52c72e..667edc0 100644
--- a/packages/lex-agent/.releaserc.json
+++ b/packages/lex-agent/.releaserc.json
@@ -9,7 +9,7 @@
     "@semantic-release/release-notes-generator",
     ["@semantic-release/exec", {
       "prepareCmd": "node -e \"const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='${nextRelease.version}';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')\"",
-      "publishCmd": "bun publish --access public --tag ${nextRelease.channel || 'latest'}"
+      "publishCmd": "npm view $(node -p \"require('./package.json').name\")@${nextRelease.version} version 2>/dev/null && echo 'Version already published, skipping' || npm publish --access public --tag ${nextRelease.channel || 'latest'}"
     }],
     "@semantic-release/github"
   ]
diff --git a/packages/oauth-client-browser/.releaserc.json b/packages/oauth-client-browser/.releaserc.json
index 02e61cd..667edc0 100644
--- a/packages/oauth-client-browser/.releaserc.json
+++ b/packages/oauth-client-browser/.releaserc.json
@@ -9,7 +9,7 @@
     "@semantic-release/release-notes-generator",
     ["@semantic-release/exec", {
       "prepareCmd": "node -e \"const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='${nextRelease.version}';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')\"",
-      "publishCmd": "npm view $(node -p \"require('./package.json').name\")@${nextRelease.version} version 2>/dev/null && echo 'Version already published, skipping' || bun publish --access public --tag ${nextRelease.channel || 'latest'}"
+      "publishCmd": "npm view $(node -p \"require('./package.json').name\")@${nextRelease.version} version 2>/dev/null && echo 'Version already published, skipping' || npm publish --access public --tag ${nextRelease.channel || 'latest'}"
     }],
     "@semantic-release/github"
   ]
diff --git a/packages/oauth-client-node/.releaserc.json b/packages/oauth-client-node/.releaserc.json
index 02e61cd..667edc0 100644
--- a/packages/oauth-client-node/.releaserc.json
+++ b/packages/oauth-client-node/.releaserc.json
@@ -9,7 +9,7 @@
     "@semantic-release/release-notes-generator",
     ["@semantic-release/exec", {
       "prepareCmd": "node -e \"const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='${nextRelease.version}';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')\"",
-      "publishCmd": "npm view $(node -p \"require('./package.json').name\")@${nextRelease.version} version 2>/dev/null && echo 'Version already published, skipping' || bun publish --access public --tag ${nextRelease.channel || 'latest'}"
+      "publishCmd": "npm view $(node -p \"require('./package.json').name\")@${nextRelease.version} version 2>/dev/null && echo 'Version already published, skipping' || npm publish --access public --tag ${nextRelease.channel || 'latest'}"
     }],
     "@semantic-release/github"
   ]
diff --git a/packages/oauth-client/.releaserc.json b/packages/oauth-client/.releaserc.json
index 02e61cd..667edc0 100644
--- a/packages/oauth-client/.releaserc.json
+++ b/packages/oauth-client/.releaserc.json
@@ -9,7 +9,7 @@
     "@semantic-release/release-notes-generator",
     ["@semantic-release/exec", {
       "prepareCmd": "node -e \"const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='${nextRelease.version}';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')\"",
-      "publishCmd": "npm view $(node -p \"require('./package.json').name\")@${nextRelease.version} version 2>/dev/null && echo 'Version already published, skipping' || bun publish --access public --tag ${nextRelease.channel || 'latest'}"
+      "publishCmd": "npm view $(node -p \"require('./package.json').name\")@${nextRelease.version} version 2>/dev/null && echo 'Version already published, skipping' || npm publish --access public --tag ${nextRelease.channel || 'latest'}"
     }],
     "@semantic-release/github"
   ]