diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d313252..f30dd5b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -63,6 +63,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [release-please]
     if: needs.release-please.outputs.release_created == 'true'
+    # Environment `npm` only allows deployments from `main`. The npm trusted
+    # publisher's "Environment name" must be `npm` too (OIDC sub changes).
+    environment: npm
     permissions:
       contents: read
       id-token: write