diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b84782a8..fab274fd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,16 +60,27 @@ jobs:
   release:
     needs: validate
     runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write # npm trusted publishing (OIDC)
     if: >
       github.event_name == 'push' &&
       github.repository == 'testing-library/user-event' &&
-      contains('refs/heads/main,refs/heads/beta,refs/heads/alpha', github.ref)
+      contains('refs/heads/main,refs/heads/beta,refs/heads/alpha', github.ref) &&
+      vars.RELEASE_DRY != 'true'
     steps:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@v4
         with:
           # semantic-release needs full history + tags to see unreleased commits
           fetch-depth: 0
+      - name: ⎔ Setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
       - name: ♻️ Restore node_modules
         uses: actions/cache/restore@v4
         with:
@@ -85,11 +96,31 @@ jobs:
       - name: 🏗️ Run build script
         run: npm run build
 
+      # JS action (not Docker) so GitHub OIDC works with npm trusted publishing
       - name: 🚀 Release
-        uses: ph-fritsche/action-release@v2
+        uses: cycjimmy/semantic-release-action@v5
         with:
-          # Only treat an explicit "true" as dry-run (unset/false publishes)
-          dry: ${{ vars.RELEASE_DRY == 'true' }}
+          semantic_version: 25
+          branches: |
+            [
+              '+([0-9])?(.{+([0-9]),x}).x',
+              'main',
+              {name: 'beta', prerelease: true},
+              {name: 'alpha', prerelease: true}
+            ]
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      # Backfill npm when a git tag/GitHub release exists but npm publish was skipped
+      - name: 📦 Ensure latest tag is on npm
+        run: |
+          TAG=$(git describe --tags --abbrev=0)
+          VERSION=${TAG#v}
+          if npm view "@testing-library/user-event@${VERSION}" version >/dev/null 2>&1; then
+            echo "npm already has ${VERSION}"
+            exit 0
+          fi
+          echo "Publishing missing ${VERSION} to npm"
+          npm install -g npm@latest
+          npm version "${VERSION}" --no-git-tag-version
+          npm publish --access public