diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 75989ae..00088c3 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -56,10 +56,14 @@ jobs:
       - name: Build
         run: yarn prepare
 
-      - name: Ensure npm >= 11.5.1 (Trusted Publishing)
+      # npm 12.0.0 ships a libnpmpublish that fails OIDC/provenance publishes
+      # with MODULE_NOT_FOUND on 'sigstore' (broke the v0.4.0 release), so
+      # stay on the 11.x line — it satisfies the >= 11.5.1 Trusted
+      # Publishing floor.
+      - name: Ensure npm 11.x >= 11.5.1 (Trusted Publishing)
         run: |
           npm --version
-          npm install -g npm@latest
+          npm install -g npm@11
           npm --version
 
       - name: Publish