diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c64bbb2..c9762a4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@v6
@@ -32,6 +34,9 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'recap-utr' && github.event_name == 'push' }}
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@v6
diff --git a/package.json b/package.json
index c0fde88..253133f 100644
--- a/package.json
+++ b/package.json
@@ -30,5 +30,9 @@
   "files": [
     "dist"
   ],
-  "exports": "./dist/index.js"
+  "exports": "./dist/index.js",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }