diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 802525c..02243e2 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -41,12 +41,5 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           node-version: lts/*
 
-      - name: 📦 Pack package
-        run: nix develop --command pnpm pack
-
       - name: 🚀 Publish package
-        shell: bash
-        run: |
-          PACKAGE_TGZ=$(ls *.tgz | head -n 1)
-          echo "Publishing package: $PACKAGE_TGZ"
-          npm publish "$PACKAGE_TGZ" --access public
+        run: nix develop --command pnpm publish --provenance --no-git-checks --access public
diff --git a/flake.nix b/flake.nix
index b67aa5e..3333f05 100644
--- a/flake.nix
+++ b/flake.nix
@@ -15,7 +15,6 @@
         devShells.default = pkgs.mkShell {
           buildInputs = with pkgs; [
             pnpm_10
-            nodejs_24
           ];
 
           shellHook = ''
diff --git a/package.json b/package.json
index 8bd4715..45a9f65 100644
--- a/package.json
+++ b/package.json
@@ -29,6 +29,7 @@
 		"lint:oxfmt": "oxfmt --no-error-on-unmatched-pattern --check .",
 		"lint:oxlint": "oxlint --max-warnings=0 --type-aware --type-check",
 		"lint:knip": "knip",
+		"preinstall": "npx only-allow pnpm",
 		"prepack": "npm pkg delete scripts.preinstall && pnpm run build",
 		"test": "vitest",
 		"coverage": "vitest run --coverage"