diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c13fde5..006e846 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -42,9 +42,8 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-      # Trusted publishing needs npm 11.5.1 or newer, pinned exactly so a
-      # release never runs an npm nobody reviewed.
-      - run: npm install -g npm@12.0.2
+      # Trusted publishing needs npm 11.5.1 or newer; node 24 has bundled a
+      # new-enough npm since 24.4, so nothing extra is installed here.
       - run: npm ci
       - run: npm test
       - name: pick channel and version