diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 84bac17..930a5d8 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   publish-npm:
     if: github.event.pull_request.merged
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:
@@ -19,6 +22,7 @@ jobs:
           cache: npm
           cache-dependency-path: package-lock.json
           node-version: 20.17.x
+          registry-url: https://registry.npmjs.org
 
       - name: Dependencies installation
         run: npm ci
@@ -26,4 +30,4 @@ jobs:
       - env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         name: Publish to npm
-        run: npm publish
+        run: npm publish --provenance --access public
diff --git a/package-lock.json b/package-lock.json
index 43ba09b..c6d6216 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@stassi/leaf",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@stassi/leaf",
-      "version": "0.0.21",
+      "version": "0.0.22",
       "cpu": [
         "arm64",
         "x64"
diff --git a/package.json b/package.json
index 4930d8e..40f11a4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@stassi/leaf",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "description": "Leaflet adapter.",
   "keywords": [
     "cartography",