diff --git a/.github/workflows/npm-publish-specific-package-not-main.yml b/.github/workflows/npm-publish-specific-package-not-main.yml
index 9bf3829e..8d8e82d5 100644
--- a/.github/workflows/npm-publish-specific-package-not-main.yml
+++ b/.github/workflows/npm-publish-specific-package-not-main.yml
@@ -15,7 +15,8 @@ on:
         required: false
 
 permissions:
-  contents: write
+  contents: read
+  id-token: write
 
 jobs:
   publish-npm:
@@ -48,8 +49,6 @@ jobs:
           fi
 
       - name: Publish to npmjs
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           if [ -z "${{ github.event.inputs.package_name }}" ]; then
             echo "Publishing all changed packages..."
diff --git a/.github/workflows/publish-not-main.yml b/.github/workflows/publish-not-main.yml
index 0fcc7065..854773a0 100644
--- a/.github/workflows/publish-not-main.yml
+++ b/.github/workflows/publish-not-main.yml
@@ -11,7 +11,8 @@ on:
           - beta
 
 permissions:
-  contents: write
+  contents: read
+  id-token: write
 
 jobs:
   publish-npm:
@@ -43,6 +44,4 @@ jobs:
           gh release create --prerelease $RELEASE_TAG --target=$GITHUB_SHA --title="$RELEASE_TAG" --generate-notes
 
       - name: Publish to npmjs
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
         run: npx lerna publish from-package --yes --dist-tag ${{ github.event.inputs.channel }} --pre-dist-tag ${{ github.event.inputs.channel }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6776cf48..dea797a2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,7 +4,8 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
+  id-token: write
 
 jobs:
   common:
@@ -42,6 +43,4 @@ jobs:
           gh release create $RELEASE_TAG --target=$GITHUB_SHA --title="$RELEASE_TAG" --generate-notes --notes-file=notes.txt
 
       - name: Publish to npmjs
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
         run: npx lerna publish from-package --yes
diff --git a/packages/auth/package.json b/packages/auth/package.json
index 07873c19..9c0f5559 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -43,6 +43,7 @@
     "@nestjs/common": "^11.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }
diff --git a/packages/cache/package.json b/packages/cache/package.json
index aead4612..abda7966 100644
--- a/packages/cache/package.json
+++ b/packages/cache/package.json
@@ -46,6 +46,7 @@
     "@nestjs/core": "^11.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }
diff --git a/packages/common/package.json b/packages/common/package.json
index a766e657..df64b2c4 100644
--- a/packages/common/package.json
+++ b/packages/common/package.json
@@ -46,6 +46,7 @@
     "@nestjs/swagger": "^11.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }
diff --git a/packages/elastic/package.json b/packages/elastic/package.json
index 50cb9b9c..448912df 100644
--- a/packages/elastic/package.json
+++ b/packages/elastic/package.json
@@ -35,6 +35,7 @@
     "@nestjs/common": "^11.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }
diff --git a/packages/http/package.json b/packages/http/package.json
index f974aaf8..79cc4f73 100644
--- a/packages/http/package.json
+++ b/packages/http/package.json
@@ -45,6 +45,7 @@
     "@nestjs/core": "^11.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }
diff --git a/packages/monitoring/package.json b/packages/monitoring/package.json
index 50e92a62..c9bc5ad3 100644
--- a/packages/monitoring/package.json
+++ b/packages/monitoring/package.json
@@ -39,6 +39,7 @@
     "@nestjs/common": "^11.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }
diff --git a/packages/rabbitmq/package.json b/packages/rabbitmq/package.json
index 3b990299..40ab7d88 100644
--- a/packages/rabbitmq/package.json
+++ b/packages/rabbitmq/package.json
@@ -41,6 +41,7 @@
     "@nestjs/common": "^11.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }
diff --git a/packages/redis/package.json b/packages/redis/package.json
index 72d8f24b..e17b193d 100644
--- a/packages/redis/package.json
+++ b/packages/redis/package.json
@@ -38,6 +38,7 @@
     "@nestjs/common": "^11.x"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }