diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8795c29..d821783 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,8 +41,11 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
 
-      - name: Update npm to latest
-        run: npm install -g npm@latest
+      # Node 22 bundles npm 10.9.x, which predates OIDC trusted publishing, so
+      # this step is required. Pin the major: npm@latest broke the release once
+      # by raising its own Node floor past .nvmrc (npm 12 wants >= 22.22.2).
+      - name: Update npm for trusted publishing
+        run: npm install -g npm@^11.5.1
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.nvmrc b/.nvmrc
index 3872cc8..c947119 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22.14.0 
+22.23.2
diff --git a/CLAUDE.md b/CLAUDE.md
index 556a434..138c6f4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -11,7 +11,7 @@ NFDomains SDK (`@txnlab/nfd-sdk`) — a TypeScript SDK for interacting with Non-
 - **`packages/sdk/`** — the SDK package (published as `@txnlab/nfd-sdk`)
 - **`examples/`** — React/Vite example apps demonstrating SDK features
 - Package manager: **pnpm v10+** with workspaces (pinned by the root `packageManager` field, which CI reads too)
-- Node version: **22.14.0** (see `.nvmrc`)
+- Node version: **22.23.2** (see `.nvmrc`)
 
 ## Commands
 
diff --git a/PUBLISHING.md b/PUBLISHING.md
index 3f745f0..9ae65a4 100644
--- a/PUBLISHING.md
+++ b/PUBLISHING.md
@@ -97,3 +97,5 @@ Overriding `--plugins` restricts the run to analysis and note rendering, which i
 **`npm ERR! 404` or an auth error during publish.** The trusted publisher configuration on npmjs.com no longer matches the workflow — check the repository, workflow filename and environment recorded there against `release.yml`.
 
 **A `node version ... is required` error.** semantic-release supports a narrow Node range; the workflow pins it from `.nvmrc`. Locally, run `nvm use` first.
+
+**`EBADENGINE` in the "Update npm for trusted publishing" step.** The pinned npm major has outgrown the Node version in `.nvmrc`. Node's bundled npm is too old for trusted publishing, so the step cannot simply be dropped — raise `.nvmrc` to a Node release the pinned npm supports. This is why the step pins a major rather than tracking `npm@latest`: releases should not break because npm shipped a new floor.