diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 11cd6c1..4ceea4d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,11 @@ on:
   push:
     branches: [main]
 
+permissions:
+  # Required for OIDC: https://docs.npmjs.com/trusted-publishers
+  id-token: write
+  contents: read
+
 # Ensure that only one instance of this workflow executes at a time.
 # If multiple PRs are merged in quick succession, there will only ever be one publish workflow running and one pending.
 concurrency: ${{ github.workflow }}
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..0a49261
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.11.0