diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml
index 5d95c494a..7d4b5a8e7 100644
--- a/.github/workflows/publish-platform.yml
+++ b/.github/workflows/publish-platform.yml
@@ -352,6 +352,17 @@ jobs:
         if: steps.check.outputs.skip_all != 'true' && steps.download.outcome == 'success'
         run: npm install -g npm@latest
 
+      - name: Strip token auth from .npmrc to force OIDC
+        if: steps.check.outputs.skip_all != 'true' && steps.download.outcome == 'success'
+        run: |
+          for f in .npmrc "$HOME/.npmrc"; do
+            if [ -f "$f" ]; then
+              sed -i.bak '/_authToken/d' "$f"
+              rm -f "$f.bak"
+              echo "Cleaned $f"
+            fi
+          done
+
       - name: Publish oh-my-opencode-${{ matrix.platform }}
         if: steps.check.outputs.skip_opencode != 'true' && steps.download.outcome == 'success'
         env:
@@ -361,9 +372,9 @@ jobs:
           cd packages/${{ matrix.platform }}
 
           if [ -n "$DIST_TAG" ]; then
-            npm publish --access public --provenance --tag "$DIST_TAG"
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
           else
-            npm publish --access public --provenance
+            npm publish --access public --provenance --loglevel verbose
           fi
         timeout-minutes: 15
 
@@ -382,8 +393,8 @@ jobs:
              package.json > tmp.json && mv tmp.json package.json
 
           if [ -n "$DIST_TAG" ]; then
-            npm publish --access public --provenance --tag "$DIST_TAG"
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
           else
-            npm publish --access public --provenance
+            npm publish --access public --provenance --loglevel verbose
           fi
         timeout-minutes: 15
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d53da6f1f..4d394f528 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -169,6 +169,17 @@ jobs:
           bunx tsc --emitDeclarationOnly
           bun run build:schema
 
+      - name: Strip token auth from .npmrc to force OIDC
+        if: steps.check.outputs.skip != 'true'
+        run: |
+          for f in .npmrc "$HOME/.npmrc"; do
+            if [ -f "$f" ]; then
+              sed -i.bak '/_authToken/d' "$f"
+              rm -f "$f.bak"
+              echo "Cleaned $f"
+            fi
+          done
+
       - name: Publish oh-my-opencode
         if: steps.check.outputs.skip != 'true'
         env:
@@ -176,9 +187,9 @@ jobs:
           NPM_CONFIG_PROVENANCE: true
         run: |
           if [ -n "$DIST_TAG" ]; then
-            npm publish --access public --provenance --tag "$DIST_TAG"
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
           else
-            npm publish --access public --provenance
+            npm publish --access public --provenance --loglevel verbose
           fi
 
       - name: Check if oh-my-openagent already published
@@ -213,9 +224,9 @@ jobs:
           ' package.json > tmp.json && mv tmp.json package.json
 
           if [ -n "$DIST_TAG" ]; then
-            npm publish --access public --provenance --tag "$DIST_TAG"
+            npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose
           else
-            npm publish --access public --provenance
+            npm publish --access public --provenance --loglevel verbose
           fi
 
       - name: Restore package.json