diff --git a/.github/workflows/publish-nightly.yml b/.github/workflows/publish-nightly.yml
new file mode 100644
index 000000000000..23370b4606cf
--- /dev/null
+++ b/.github/workflows/publish-nightly.yml
@@ -0,0 +1,60 @@
+name: Publish nightly
+on:
+# Recurring publish disabled as tokens were revoked https://github.com/orgs/community/discussions/179562 and this is not a big priority. 
+#   schedule:
+#     - cron: '0 5 * * *'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  check_date:
+    runs-on: ubuntu-latest
+    outputs:
+      should_run: ${{ steps.should_run.outputs.should_run }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: print latest_commit
+        run: echo ${{ github.sha }}
+
+      - id: should_run
+        continue-on-error: true
+        if: ${{ github.event_name == 'schedule' }}
+        run: |
+          commit_count=$(git rev-list --count --after="1 day" ${{ github.sha }})
+
+          if [[ "$commit_count" -gt 0 ]]; then
+            echo "should_run=true" >> $GITHUB_OUTPUT
+          else
+            echo "should_run=false" >> $GITHUB_OUTPUT
+          fi
+
+  publish:
+    # Prevent scheduled job from running if...
+    # 1) this is a fork
+    # 2) there has not been a change in the last day
+    needs: check_date
+    if: |
+      github.event_name != 'schedule' ||
+      (github.repository == 'GoogleChrome/lighthouse' && ${{ needs.check_date.outputs.should_run != 'false' }})
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.19'
+          registry-url: https://registry.npmjs.org/
+      - run: yarn --frozen-lockfile
+
+      # Build report bundles needed for publishing.
+      - run: yarn build-report
+
+      - name: Publish to npm
+        run: |
+          npm whoami
+          bash $GITHUB_WORKSPACE/.github/scripts/bump-nightly-version.sh
+          npm publish --tag next
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+          CI: true
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 368de92e8f52..531e9c30c90b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,41 +1,16 @@
-name: Publish nightly
+name: Publish
 on:
-# Recurring publish disabled as tokens were revoked https://github.com/orgs/community/discussions/179562 and this is not a big priority. 
-#   schedule:
-#     - cron: '0 5 * * *'
-  workflow_dispatch: {}
+  push:
+    tags:
+      - 'v*' # Runs on pushing version tags
+  workflow_dispatch: {} # Manual run
 
 jobs:
-  check_date:
-    runs-on: ubuntu-latest
-    outputs:
-      should_run: ${{ steps.should_run.outputs.should_run }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: print latest_commit
-        run: echo ${{ github.sha }}
-
-      - id: should_run
-        continue-on-error: true
-        if: ${{ github.event_name == 'schedule' }}
-        run: |
-          commit_count=$(git rev-list --count --after="1 day" ${{ github.sha }})
-
-          if [[ "$commit_count" -gt 0 ]]; then
-            echo "should_run=true" >> $GITHUB_OUTPUT
-          else
-            echo "should_run=false" >> $GITHUB_OUTPUT
-          fi
-
   publish:
-    # Prevent scheduled job from running if...
-    # 1) this is a fork
-    # 2) there has not been a change in the last day
-    needs: check_date
-    if: |
-      github.event_name != 'schedule' ||
-      (github.repository == 'GoogleChrome/lighthouse' && ${{ needs.check_date.outputs.should_run != 'false' }})
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -43,15 +18,10 @@ jobs:
           node-version: '22.19'
           registry-url: https://registry.npmjs.org/
       - run: yarn --frozen-lockfile
-
-      # Build report bundles needed for publishing.
-      - run: yarn build-report
-
+      - run: yarn build-all
       - name: Publish to npm
         run: |
-          npm whoami
-          bash $GITHUB_WORKSPACE/.github/scripts/bump-nightly-version.sh
-          npm publish --tag next
+          npm install -g npm@latest
+          npm publish --provenance --access public --registry https://registry.npmjs.org/
         env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
           CI: true
diff --git a/package.json b/package.json
index 796a167916ed..b733211aaa0a 100644
--- a/package.json
+++ b/package.json
@@ -5,9 +5,9 @@
   "description": "Automated auditing, performance metrics, and best practices for the web.",
   "main": "./core/index.js",
   "bin": {
-    "lighthouse": "./cli/index.js",
-    "chrome-debug": "./core/scripts/manual-chrome-launcher.js",
-    "smokehouse": "./cli/test/smokehouse/frontends/smokehouse-bin.js"
+    "lighthouse": "cli/index.js",
+    "chrome-debug": "core/scripts/manual-chrome-launcher.js",
+    "smokehouse": "cli/test/smokehouse/frontends/smokehouse-bin.js"
   },
   "engines": {
     "node": ">=22.19"
@@ -213,7 +213,10 @@
     "puppeteer/**/devtools-protocol": "0.0.1608973",
     "puppeteer-core/**/devtools-protocol": "0.0.1608973"
   },
-  "repository": "GoogleChrome/lighthouse",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GoogleChrome/lighthouse.git"
+  },
   "keywords": [
     "google",
     "chrome",