diff --git a/.github/workflows/ts-publish-npm.yml b/.github/workflows/ts-publish-npm.yml
index e9fc495..cb72e37 100644
--- a/.github/workflows/ts-publish-npm.yml
+++ b/.github/workflows/ts-publish-npm.yml
@@ -67,10 +67,11 @@ jobs:
           fi
 
       # Preferred auth is the npmjs.com Trusted Publisher for this workflow
-      # (no secret, no expiry). NPM_TOKEN is only a fallback while the trusted
-      # publisher is not configured yet; delete the secret once it is.
+      # (no secret, no expiry); npm then generates provenance automatically.
+      # NPM_TOKEN is only a fallback while the trusted publisher is not
+      # configured yet; delete the secret once it is.
       - name: Publish to npm
         working-directory: ts
-        run: npm publish --tag ${{ steps.npm-tag.outputs.tag }} --access public --provenance
+        run: npm publish --tag ${{ steps.npm-tag.outputs.tag }} --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}