diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 292ef4c74..c016413a8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -292,7 +292,7 @@ jobs:
           NPM_DIST_TAG: latest
           NPM_REGISTRY: registry.npmjs.org
           NPM_CONFIG_PROVENANCE: "true"
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TRUSTED_PUBLISHER: "true"
         run: npx -p publib@latest publib-npm
   aws-cdk-cloud-assembly-schema_release_maven:
     name: "@aws-cdk/cloud-assembly-schema: Publish to Maven Central"
@@ -861,7 +861,7 @@ jobs:
           NPM_DIST_TAG: latest
           NPM_REGISTRY: registry.npmjs.org
           NPM_CONFIG_PROVENANCE: "true"
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TRUSTED_PUBLISHER: "true"
         run: npx -p publib@latest publib-npm
   aws-cdk-cli-lib-alpha_release_maven:
     name: "@aws-cdk/cli-lib-alpha: Publish to Maven Central"
diff --git a/projenrc/jsii.ts b/projenrc/jsii.ts
index 4f3c82a22..b74b6d85a 100644
--- a/projenrc/jsii.ts
+++ b/projenrc/jsii.ts
@@ -270,6 +270,7 @@ export class JsiiBuild extends pj.Component {
       registry: tsProject.package.npmRegistry,
       npmTokenSecret: tsProject.package.npmTokenSecret,
       npmProvenance: tsProject.package.npmProvenance,
+      trustedPublishing: true,
       // No support for CodeArtifact here
       // codeArtifactOptions: tsProject.codeArtifactOptions,
     };