diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml
index 07d09380d7..1aedc3e61d 100644
--- a/.github/workflows/changesets.yml
+++ b/.github/workflows/changesets.yml
@@ -6,14 +6,14 @@ on:
       - main
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
-permissions: {} # remove permissions and set explicitly under "permissions:" below
+permissions:
+  id-token: write # for NPM provenance - developers can verify where and how it was built
+  contents: write # to create release by changesets/action below
+  pull-requests: write # to create pull request by changesets/action below
+
 jobs:
   release:
     if: github.repository == 'calcom/cal.com' # prevent this action from running on forks
-    permissions:
-      id-token: write # for NPM provenance - developers can verify where and how it was built
-      contents: write # to create release by changesets/action below
-      pull-requests: write # to create pull request by changesets/action below
     name: Release
     runs-on: buildjet-4vcpu-ubuntu-2204
     steps:
@@ -21,8 +21,15 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Setup Node and registry for OIDC
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
       - name: Setup node, yarn and install dependencies
         uses: ./.github/actions/yarn-install
+      - name: Install npm at version supporting OIDC
+        run: npm install -g npm@11.5.1
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
@@ -33,6 +40,7 @@ jobs:
           title: "chore: version packages" # PR title
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: "true"
           VITE_BOOKER_EMBED_OAUTH_CLIENT_ID: ${{ secrets.VITE_BOOKER_EMBED_OAUTH_CLIENT_ID }}
           VITE_BOOKER_EMBED_API_URL: ${{ secrets.VITE_BOOKER_EMBED_API_URL }}
           NEXT_PUBLIC_WEBAPP_URL: ${{ secrets.NEXT_PUBLIC_WEBAPP_URL }}