diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8971841..63985a2 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -17,12 +17,14 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - uses: pnpm/action-setup@v5
+
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
-          cache: "pnpm"
+          package-manager-cache: false # never use caching in release builds
 
       - run: pnpm install
       - run: pnpm build
@@ -30,8 +32,13 @@ jobs:
 
       # Might need --recursive in this publish command?
       - name: Read version and publish
+        env:
+          # Clear the sentinel value setup-node writes; otherwise npm tries to
+          # use it as a bearer token and rejects OIDC.
+          # https://github.com/actions/setup-node/issues/1440#issuecomment-3571890875
+          NODE_AUTH_TOKEN: ""
         run: |
-          VERSION=$(jq -r .version package.json)
+          VERSION=$(jq -r .version packages/deck.gl-geoarrow/package.json)
           if [[ "$VERSION" == *alpha* || "$VERSION" == *beta* ]]; then
             pnpm publish --no-git-checks --tag beta
           else