diff --git a/.github/workflows/build-test-publish-superscript-npm.yml b/.github/workflows/build-test-publish-superscript-npm.yml
index 4cdce68..fbf234d 100644
--- a/.github/workflows/build-test-publish-superscript-npm.yml
+++ b/.github/workflows/build-test-publish-superscript-npm.yml
@@ -159,8 +159,8 @@ jobs:
       - name: Publish to NPM
         if: github.event_name == 'push' && github.ref == 'refs/heads/master'
         run: |
-          # Trusted publishing needs npm 11.5.1 or later.
-          npm install -g npm@latest
+          # Trusted publishing needs npm 11.5.1 or later; npm 12 needs Node 22+.
+          npm install -g npm@^11.5.1
           cd wasm
           # Try a normal publish first; if it fails (e.g. first-time publish of a
           # scoped package), retry with --access public.