diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e304c0e..c1484cf 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -36,6 +36,7 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: npm install -g npm@latest # we are doing this to make sure theat the gloabally installed npm is new enough to support OIDC
       - name: Publish to NPM
         run: NPM_CONFIG_PROVENANCE=true pnpm release-plan publish
         env: