diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9e30dd7..289f680 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,5 +1,7 @@
 name: CI
+
 on: [push]
+
 jobs:
   build:
     name: Build, lint, and test on Deno
diff --git a/.github/workflows/npm.yml b/.github/workflows/publish.yml
similarity index 85%
rename from .github/workflows/npm.yml
rename to .github/workflows/publish.yml
index 9872be5..f1dfb9e 100644
--- a/.github/workflows/npm.yml
+++ b/.github/workflows/publish.yml
@@ -1,4 +1,5 @@
-name: Publish NPM Package
+name: Publish to JSR and NPM
+
 on:
   workflow_dispatch:
   release:
@@ -7,6 +8,11 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
     steps:
       - uses: actions/checkout@v4
 
@@ -14,12 +20,6 @@ jobs:
         with:
           deno-version: v2.x
 
-      - name: check format
-        run: deno fmt --check
-
-      - name: check linting
-        run: deno lint
-
       - name: Publish package to JSR
         run: |
           deno run -A ./scripts/prep-jsr.ts ${{ github.ref }}