diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0519c04..78fe8ff 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -38,4 +38,3 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
diff --git a/README.md b/README.md
index 1efa6a0..0edce78 100644
--- a/README.md
+++ b/README.md
@@ -254,7 +254,7 @@ npm run version-packages
 npm run publish-packages
 ```
 
-The workflow sets `NPM_CONFIG_PROVENANCE=true`, so packages are published with npm provenance.
+The workflow publishes with the `NPM_TOKEN` repository secret. Use npm trusted publishing later if you want tokenless provenance publishing.
 
 Local release commands are still available when needed: