diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f78b805..7707ef7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,4 +59,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # setup-node's .npmrc reads ${NODE_AUTH_TOKEN}; without it the publish is anonymous (E404).
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: "true"